diff --git a/pkg/init/Dockerfile b/pkg/init/Dockerfile
index b4550ae9f..a5d54d8a5 100644
--- a/pkg/init/Dockerfile
+++ b/pkg/init/Dockerfile
@@ -1,7 +1,14 @@
-# Use sha256 here to get a fixed version
-FROM alpine:edge@sha256:99588bc8883c955c157d18fc3eaa4a3c1400c223e6c7cabca5f600a3e9f8d5cd
+FROM linuxkit/alpine:6336329f15b4166514782eaa555cf0ffd35c519c@sha256:f6c2ce92910b1d6e4e5557850a554f4a3ae9f66c1e89ad86a24d6c6e550f165e AS mirror
+RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
+RUN apk add --no-cache --initdb -p /out alpine-baselayout busybox musl
+
+# Remove apk residuals. We have a read-only rootfs, so apk is of no use.
+RUN rm -rf /out/etc/apk /out/lib/apk /out/var/cache
+
+FROM scratch
 ENTRYPOINT []
 CMD []
 WORKDIR /
+COPY --from=mirror /out/ /
 COPY init /
 COPY etc etc/
diff --git a/pkg/init/Makefile b/pkg/init/Makefile
index bc5b840d6..135e8b2e2 100644
--- a/pkg/init/Makefile
+++ b/pkg/init/Makefile
@@ -1,14 +1,15 @@
 .PHONY: tag push
 default: push
 
+ORG?=linuxkit
 IMAGE=init
 DEPS=Dockerfile init $(wildcard etc/*) $(wildcard etc/init.d/*)
 
 HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
 
 tag: $(DEPS)
-	docker build --no-cache --network=none -t linuxkit/$(IMAGE):$(HASH) .
+	docker build --no-cache --network=none -t $(ORG)/$(IMAGE):$(HASH) .
 
 push: tag
-	docker pull linuxkit/$(IMAGE):$(HASH) || \
-	docker push linuxkit/$(IMAGE):$(HASH)
+	docker pull $(ORG)/$(IMAGE):$(HASH) || \
+	docker push $(ORG)/$(IMAGE):$(HASH)