diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 8dde7bb..c2c4102 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -15,7 +15,6 @@ stages:
  - check
  - build
 
-
 dockerimage_builder:
   stage: prepare
   before_script:
@@ -34,7 +33,6 @@ dockerimage_builder:
     refs:
       - schedules
 
-
 dockerimage_security_scanner:
   stage: prepare
   before_script:
@@ -71,18 +69,18 @@ security_scanner:
     - dedicated
 
 .squashfs_template: &squashfs_template
+  image: $DOCKER_IMAGE_BUILDER
   stage: build
-  before_script:
-    - apk add --no-cache make
   services:
-   - docker:dind
+    - docker:dind
   script:
-   - make images/debian-buster.squashfs
-   - find images -type f > images.txt
+    - scripts/packer.sh debian-buster
+    - scripts/torrent.sh debian-buster.squashfs
+    - find images -type f > images.txt
   artifacts:
     paths:
-     - images
-     - images.txt
+      - images
+      - images.txt
   tags:
     - fablab
     - ssd
diff --git a/Makefile b/Makefile
index 918a31c..7e60e3b 100644
--- a/Makefile
+++ b/Makefile
@@ -58,29 +58,28 @@ images/debian-buster.squashfs: images
 	docker run \
 		--rm \
 		-v /var/run/docker.sock:/var/run/docker.sock \
-		-v "${PWD}/packer:/workdir" \
-		-v "${PWD}/aria2c:/workdir/aria2c" \
-		-v "${PWD}/images:/images" \
-		-e "user=`id -u`" \
-		-e "group=`id -g`" \
+		-v "${PWD}:${PWD}" \
+		-w "${PWD}" \
+		-u `id -u`:`id -g` \
 		-e "IMAGES=${PWD}/images" \
 		-e "ANNOUNCE=$(ANNOUNCE)" \
 		-e "WEBSEED=$(WEBSEED)" \
 		-e "COMPRESSION_LEVEL=$(COMPRESSION_LEVEL)" \
 		$(ci_environment) \
 		"$(DOCKER_IMAGE_BUILDER)" \
+		scripts/packer.sh \
 		debian-buster
 
 images/debian-buster.torrent: images
 	docker run \
 		--rm \
-		-v "${PWD}/images:/images" \
-		-e "user=`id -u`" \
-		-e "group=`id -g`" \
+		-v "${PWD}:${PWD}" \
+		-w "${PWD}" \
+		-u `id -u`:`id -g` \
 		-e "ANNOUNCE=$(ANNOUNCE)" \
 		-e "WEBSEED=$(WEBSEED)" \
-		-e "TASK=torrent" \
 		"$(DOCKER_IMAGE_BUILDER)" \
+		scripts/torrent.sh \
 		debian-buster
 
 .PHONY: ansible
@@ -88,14 +87,14 @@ ansible:
 	docker run \
 		--rm \
 		-v "${PWD}/packer/ansible:/ansible" \
-		-e "user=`id -u`" \
-		-e "group=`id -g`" \
+		-u `id -u`:`id -g` \
 		-e "ANNOUNCE=$(ANNOUNCE)" \
 		-e "WEBSEED=$(WEBSEED)" \
-		-e "TASK=ansible" \
 		-v "${SSH_AUTH_SOCK}:/var/run/ssh_auth_sock" \
 		-e "SSH_AUTH_SOCK=/var/run/ssh_auth_sock" \
+		-w /ansible \
 		"$(DOCKER_IMAGE_BUILDER)" \
+			/usr/bin/ansible-playbook \
 			-i inventories \
 			$(if $(ANSIBLE_TAGS),-t $(ANSIBLE_TAGS),) \
 			-l $(ANSIBLE_LIMIT) \
diff --git a/builder/Dockerfile b/builder/Dockerfile
index 6568fee..cb81957 100644
--- a/builder/Dockerfile
+++ b/builder/Dockerfile
@@ -46,7 +46,4 @@ RUN gpg --import /usr/local/share/hashicorp.asc \
 
 WORKDIR /workdir
 
-COPY entrypoint.sh /usr/local/bin/entrypoint.sh
-
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 # vim: ts=4 sw=4 sts=4 noet:
diff --git a/builder/entrypoint.sh b/builder/entrypoint.sh
deleted file mode 100755
index f187041..0000000
--- a/builder/entrypoint.sh
+++ /dev/null
@@ -1,66 +0,0 @@
-#!/bin/sh
-set -e
-
-make_torrent() {
-	(cd /images
-		if [ "$NAME" = "" ]; then
-			# remove file extension
-			NAME="$(echo "$1" | sed 's/\.[^.]*//')"
-		fi
-
-		if [ "$WEBSEED" = "" ]; then
-			echo '$WEBSEED not provided' >&2
-			exit 1
-		fi
-		if [ "$ANNOUNCE" = "" ]; then
-			echo '$ANNOUNCE not provided' >&2
-			exit 1
-		fi
-
-		TORRENT_FILE="$NAME.torrent"
-		WEBSEED_URL="$WEBSEED/$1"
-
-		if [ -e "$TORRENT_FILE" ]; then rm "$TORRENT_FILE"; fi
-
-		mktorrent \
-			-n "$NAME" \
-			-a "$ANNOUNCE" \
-			-o "$TORRENT_FILE" \
-			-l 22 \
-			-w "$WEBSEED_URL" \
-			"$1"
-
-		if [ "$user" != "" ] && [ "$group" != "" ]; then
-			chown "$user:$group" "$TORRENT_FILE"
-		fi
-	)
-}
-
-run_packer() {
-	packer build "$NAME.json"
-
-	if [ "$user" != "" ] && [ "$group" != "" ]; then
-		chown $user:$group "/images/${NAME}."*
-	fi
-}
-
-NAME="$1"
-
-if [ "$NAME" = "" ]; then
-	echo 'no name supplied, stopping.' >&2
-	exit 1
-fi
-
-export NAME
-
-if [ -z "$TASK" ] || [ "$TASK" == "packer" ]; then
-	run_packer
-fi
-if [ -z "$TASK" ] || [ "$TASK" == "torrent" ]; then
-	make_torrent "$NAME.squashfs"
-fi
-if [ "$TASK" == "ansible" ]; then
-	cd /ansible
-	/usr/bin/ansible-playbook "$@"
-fi
-
diff --git a/scripts/packer.sh b/scripts/packer.sh
new file mode 100755
index 0000000..8b51ce6
--- /dev/null
+++ b/scripts/packer.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -o nounset
+
+export NAME="$1"
+mkdir -p images
+export IMAGES="$(realpath images)"
+
+cd packer
+
+packer build "$NAME.json"
diff --git a/scripts/torrent.sh b/scripts/torrent.sh
new file mode 100755
index 0000000..fdab0fc
--- /dev/null
+++ b/scripts/torrent.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+set -o nounset
+
+cd images
+
+NAME="$1"
+
+if [ "$NAME" = "" ]; then
+	# remove file extension
+	NAME="$(echo "$1" | sed 's/\.[^.]*//')"
+fi
+
+if [ "$WEBSEED" = "" ]; then
+	echo '$WEBSEED not provided' >&2
+	exit 1
+fi
+if [ "$ANNOUNCE" = "" ]; then
+	echo '$ANNOUNCE not provided' >&2
+	exit 1
+fi
+
+TORRENT_FILE="$NAME.torrent"
+WEBSEED_URL="$WEBSEED/$1"
+
+if [ -e "$TORRENT_FILE" ]; then rm "$TORRENT_FILE"; fi
+
+mktorrent \
+	-n "$NAME" \
+	-a "$ANNOUNCE" \
+	-o "$TORRENT_FILE" \
+	-l 22 \
+	-w "$WEBSEED_URL" \
+	"$1"