diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..8541464a7
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1 @@
+deploy
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 045d95666..904dd6a42 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -27,23 +27,6 @@ jobs:
       run: go test -coverprofile=coverage.txt ./...
     - name: upload codecov
       run: bash <(curl -s https://codecov.io/bash)
-    - name: Build binaries
-      run: make
-    - name: Upload tink-server binary
-      uses: actions/upload-artifact@v2
-      with:
-        name: tink-server
-        path: ./cmd/tink-server/tink-server
-    - name: Upload tink-cli binary
-      uses: actions/upload-artifact@v2
-      with:
-        name: tink-cli
-        path: ./cmd/tink-cli/tink-cli
-    - name: Upload tink-worker binary
-      uses: actions/upload-artifact@v2
-      with:
-        name: tink-worker
-        path: ./cmd/tink-worker/tink-worker
     - uses: cachix/install-nix-action@v10
       with:
         nix_path: nixpkgs=channel:nixos-unstable
@@ -60,40 +43,10 @@ jobs:
         echo ::set-output name=tink-worker-tags::quay.io/tinkerbell/tink-worker:latest,quay.io/tinkerbell/tink-worker:sha-${GITHUB_SHA::8}
     - name: Checkout code
       uses: actions/checkout@v2
-    - name: Download tink-cli binary
-      uses: actions/download-artifact@v2
-      with:
-        name: tink-cli
-        path: ./cmd/tink-cli
-    - name: Download tink-server binary
-      uses: actions/download-artifact@v2
-      with:
-        name: tink-server
-        path: ./cmd/tink-server
-    - name: Download tink-worker binary
-      uses: actions/download-artifact@v2
-      with:
-        name: tink-worker
-        path: ./cmd/tink-worker
-    - name: set tink-worker permission
-      run: chmod +x  ./cmd/tink-worker/tink-worker
-    - name: set tink-cli permission
-      run: chmod +x  ./cmd/tink-cli/tink-cli
-    - name: set tink-server permission
-      run: chmod +x  ./cmd/tink-server/tink-server
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v1
-    - name: Login to quay.io
-      uses: docker/login-action@v1
-      if: ${{ startsWith(github.ref, 'refs/heads/master') }}
-      with:
-        registry: quay.io
-        username: ${{ secrets.QUAY_USERNAME }}
-        password: ${{ secrets.QUAY_PASSWORD }}
     - name: quay.io/tinkerbell/tink
       uses: docker/build-push-action@v2
       with:
-        context: ./cmd/tink-server/
+        context: .
         file: ./cmd/tink-server/Dockerfile
         cache-from: type=registry,ref=quay.io/tinkerbell/tink:latest
         push: ${{ startsWith(github.ref, 'refs/heads/master') }}
@@ -101,7 +54,7 @@ jobs:
     - name: quay.io/tinkerbell/tink-cli
       uses: docker/build-push-action@v2
       with:
-        context: ./cmd/tink-cli/
+        context: .
         file: ./cmd/tink-cli/Dockerfile
         cache-from: type=registry,ref=quay.io/tinkerbell/tink-cli:latest
         push: ${{ startsWith(github.ref, 'refs/heads/master') }}
@@ -109,7 +62,7 @@ jobs:
     - name: quay.io/tinkerbell/tink-worker
       uses: docker/build-push-action@v2
       with:
-        context: ./cmd/tink-worker/
+        context: .
         file: ./cmd/tink-worker/Dockerfile
         cache-from: type=registry,ref=quay.io/tinkerbell/tink-worker:latest
         push: ${{ startsWith(github.ref, 'refs/heads/master') }}
diff --git a/cmd/tink-cli/Dockerfile b/cmd/tink-cli/Dockerfile
index bf6c38ed8..fd1ba22a4 100644
--- a/cmd/tink-cli/Dockerfile
+++ b/cmd/tink-cli/Dockerfile
@@ -1,8 +1,10 @@
-FROM alpine:3.11
-
-CMD sleep infinity
+FROM golang:1.15-alpine
+RUN apk add --no-cache --update --upgrade ca-certificates make git
+COPY . /usr/myapp
+WORKDIR /usr/myapp
+RUN make cli
 
+FROM alpine:3.11
+ENTRYPOINT ["/usr/bin/tink-cli"]
 RUN apk add --no-cache --update --upgrade ca-certificates
-
-COPY tink-cli /bin/tink
-COPY sample.tmpl /tmp
+COPY --from=0 /usr/myapp/cmd/tink-cli/tink-cli /usr/bin/tink-cli
diff --git a/cmd/tink-server/Dockerfile b/cmd/tink-server/Dockerfile
index 3a2a5939e..5ae4eee0a 100644
--- a/cmd/tink-server/Dockerfile
+++ b/cmd/tink-server/Dockerfile
@@ -1,10 +1,14 @@
-FROM alpine:3.11
+FROM golang:1.15-alpine
+RUN apk add --no-cache --update --upgrade ca-certificates make git
+COPY . /usr/myapp
+WORKDIR /usr/myapp
+RUN make server
 
-ENTRYPOINT ["tink-server"]
+FROM alpine:3.11
+ENTRYPOINT ["/usr/bin/tink-server"]
 EXPOSE 42113
 EXPOSE 42114
 
 RUN apk add --update ca-certificates && \
     apk add --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing cfssl
-
-COPY tink-server /bin/
+COPY --from=0 /usr/myapp/cmd/tink-server/tink-server /usr/bin/tink-server
diff --git a/cmd/tink-worker/Dockerfile b/cmd/tink-worker/Dockerfile
index e264c2c8f..cfb200365 100644
--- a/cmd/tink-worker/Dockerfile
+++ b/cmd/tink-worker/Dockerfile
@@ -1,7 +1,10 @@
-FROM alpine:3.11
-
-ENTRYPOINT [ "/tink-worker" ]
+FROM golang:1.15-alpine
+RUN apk add --no-cache --update --upgrade ca-certificates make git
+COPY . /usr/myapp
+WORKDIR /usr/myapp
+RUN make worker
 
+FROM alpine:3.11
+ENTRYPOINT [ "/usr/bin/tink-worker" ]
 RUN apk add --no-cache --update --upgrade ca-certificates
-
-COPY tink-worker /tink-worker
+COPY --from=0 /usr/myapp/cmd/tink-worker/tink-worker /usr/bin/tink-worker