diff --git a/base/alpine-build-toybox/Dockerfile b/base/alpine-build-toybox/Dockerfile
deleted file mode 100644
index e9a72831c..000000000
--- a/base/alpine-build-toybox/Dockerfile
+++ /dev/null
@@ -1,17 +0,0 @@
-FROM alpine:3.5
-RUN \
-  apk update && apk upgrade && \
-  apk add \
-  automake \
-  bash \
-  build-base \
-  git \
-  && true
-COPY . .
-# 0.7.2
-ENV LDFLAGS=--static
-RUN git clone https://github.com/landley/toybox.git && \
-  cd toybox && git checkout b27d5d9ad0c56014d8661d91f69ee498bbbe4cf9 && \
-  make defconfig
-WORKDIR /toybox
-ENTRYPOINT ["/build.sh"]
diff --git a/base/alpine-build-toybox/Makefile b/base/alpine-build-toybox/Makefile
deleted file mode 100644
index 03382e927..000000000
--- a/base/alpine-build-toybox/Makefile
+++ /dev/null
@@ -1,29 +0,0 @@
-.PHONY: tag push
-
-BASE=alpine:3.5
-IMAGE=alpine-build-toybox
-
-default: push
-
-hash: Dockerfile build.sh
-	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
-	tar cf - $^ | docker build --no-cache -t $(IMAGE):build -
-	docker run --rm --entrypoint sh $(IMAGE):build -c 'cat /Dockerfile /build.sh /lib/apk/db/installed | sha1sum' | sed 's/ .*//' > hash
-
-push: hash
-	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
-		(docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash) && \
-		 docker push linuxkit/$(IMAGE):$(shell cat hash))
-	docker rmi $(IMAGE):build
-	rm -f hash
-
-tag: hash
-	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
-		docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash)
-	docker rmi $(IMAGE):build
-	rm -f hash
-
-clean:
-	rm -f hash
-
-.DELETE_ON_ERROR:
diff --git a/base/alpine-build-toybox/build.sh b/base/alpine-build-toybox/build.sh
deleted file mode 100755
index d6b16fd58..000000000
--- a/base/alpine-build-toybox/build.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-FILES=$@
-make $FILES > /dev/null
-[ $# -eq 0 ] && FILES=toybox
-# TODO symlinks if just use toybox
-mkdir -p /out/bin
-mv $FILES /out/bin
-printf "FROM scratch\nCOPY bin/ bin/\n" > /out/Dockerfile
-cd /out
-tar cf - .
diff --git a/base/toybox-media/Makefile b/base/toybox-media/Makefile
deleted file mode 100644
index 1206d6056..000000000
--- a/base/toybox-media/Makefile
+++ /dev/null
@@ -1,28 +0,0 @@
-.PHONY: tag push
-BASE=linuxkit/alpine-build-toybox:1855c262e3b2b252540bab17dc09f0bb292b0633@sha256:ef748ed99678ac0a72ccccb975c45bc1c7b706fe9047c3ac62b2b80025b33d3f
-IMAGE=toybox-media
-
-default: push
-
-hash: 
-	docker run --rm $(BASE) ls tar sh find sha1sum | \
-		docker build -q -t $(IMAGE):build -
-	docker run --rm $(IMAGE):build tar cf - bin | docker run -i $(IMAGE):build sha1sum -b - > hash
-
-push: hash
-	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
-		(docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash) && \
-		 docker push linuxkit/$(IMAGE):$(shell cat hash))
-	docker rmi $(IMAGE):build
-	rm -f hash
-
-tag: hash
-	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
-		docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash)
-	docker rmi $(IMAGE):build
-	rm -f hash
-
-clean:
-	rm -f hash
-
-.DELETE_ON_ERROR:
diff --git a/tools/toybox-media/Dockerfile b/tools/toybox-media/Dockerfile
new file mode 100644
index 000000000..64e9c1564
--- /dev/null
+++ b/tools/toybox-media/Dockerfile
@@ -0,0 +1,18 @@
+FROM linuxkit/c-compile:f52f485825c890d581e82a62af6906c1d33d8e5d@sha256:473fd283a090d3546e93915adacf00c69a23ff615c95c968c4a40e8723985853 AS toybox-build
+COPY . .
+ENV FILES="ls tar sh find sha1sum"
+# 0.7.2
+ENV LDFLAGS=--static
+RUN git clone https://github.com/landley/toybox.git && \
+  cd toybox && git checkout b27d5d9ad0c56014d8661d91f69ee498bbbe4cf9 && \
+  make defconfig
+WORKDIR /toybox
+RUN make ${FILES}
+RUN mkdir -p /out/bin
+RUN cp ${FILES} /out/bin
+
+FROM scratch
+ENTRYPOINT []
+CMD []
+WORKDIR /
+COPY --from=toybox-build out/bin bin/
diff --git a/tools/toybox-media/Makefile b/tools/toybox-media/Makefile
new file mode 100644
index 000000000..c50f62ee4
--- /dev/null
+++ b/tools/toybox-media/Makefile
@@ -0,0 +1,26 @@
+.PHONY: tag push
+default: push
+
+IMAGE=toybox-media
+SHA_IMAGE=alpine:3.5@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
+DEPS=Dockerfile Makefile
+
+hash: $(DEPS)
+	find $^ -type f | xargs cat | docker run --rm -i $(SHA_IMAGE) sha1sum - | sed 's/ .*//' > hash
+
+tag: hash
+	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
+		(docker build --no-cache -t $(IMAGE):build . && \
+		 docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash))
+
+push: tag
+	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
+		docker push linuxkit/$(IMAGE):$(shell cat hash)
+	rm -f hash
+	docker rmi $(IMAGE):build || true
+
+clean:
+	rm -f hash
+	docker rmi $(IMAGE):build || true
+
+.DELETE_ON_ERROR:
diff --git a/tools/toybox-media/README.md b/tools/toybox-media/README.md
new file mode 100644
index 000000000..93b1db435
--- /dev/null
+++ b/tools/toybox-media/README.md
@@ -0,0 +1,3 @@
+`linuxkit/toybox-media` is a small container image, which can be use
+to distribute other files in. It contains a basic shell, `tar`, `ls`,
+`find`, and `sha1sum`. It's compiled from [toybox](https://github.com/landley/toybox.git).