diff --git a/tools/alpine/Dockerfile b/tools/alpine/Dockerfile
index 06645d186..b4f947728 100644
--- a/tools/alpine/Dockerfile
+++ b/tools/alpine/Dockerfile
@@ -25,10 +25,19 @@ RUN abuild-sign /mirror/$(uname -m)/APKINDEX.tar.gz
 # set this as our repo
 RUN echo "/mirror" > /etc/apk/repositories && apk update
 
+# add Go validation tools
+COPY go-compile.sh /go/bin/
+RUN apk add --no-cache build-base git go
+ENV GOPATH=/go PATH=$PATH:/go/bin
+RUN go get -u github.com/golang/lint/golint
+RUN go get -u github.com/gordonklaus/ineffassign
+RUN go get -u github.com/LK4D4/vndr
+
 FROM alpine:edge
 
 COPY --from=mirror /etc/apk/repositories /etc/apk/repositories
 COPY --from=mirror /etc/apk/keys /etc/apk/keys/
 COPY --from=mirror /mirror /mirror/
+COPY --from=mirror /go/bin /go/bin/
 
 RUN apk update && apk upgrade -a
diff --git a/tools/alpine/Makefile b/tools/alpine/Makefile
index 06671198c..d5447d99b 100644
--- a/tools/alpine/Makefile
+++ b/tools/alpine/Makefile
@@ -6,14 +6,10 @@ BASE=alpine:edge
 
 default: push
 
-define NEWLINE
-
-endef
-
-hash: Dockerfile packages
+hash:
 	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
-	tar cf - $^ | docker build --no-cache -t $(IMAGE):build -
-	docker run --rm $(IMAGE):build sh -c 'find /mirror -name '*.apk' -type f | xargs cat | cat /lib/apk/db/installed - | sha1sum' | sed 's/ .*//' > $@
+	docker build --no-cache -t $(IMAGE):build .
+	docker run --rm $(IMAGE):build sh -c 'echo /lib/apk/db/installed $$(find /mirror -name '*.apk' -type f) $$(find /go/bin -type f) | xargs cat | sha1sum' | sed 's/ .*//' > $@
 
 push: hash
 	docker pull $(ORG)/$(IMAGE):$(shell cat hash) || \
@@ -31,5 +27,3 @@ tag: hash
 
 clean:
 	rm -f hash
-
-.DELETE_ON_ERROR:
diff --git a/tools/alpine/go-compile.sh b/tools/alpine/go-compile.sh
new file mode 100755
index 000000000..abe1f2909
--- /dev/null
+++ b/tools/alpine/go-compile.sh
@@ -0,0 +1,46 @@
+#!/bin/sh
+
+set -e
+
+usage() {
+	echo "Usage: dir"
+	exit 1
+}
+
+[ $# = 0 ] && usage
+
+dir="$1"
+
+cd "$dir"
+
+# lint before building
+>&2 echo "gofmt..."
+test -z $(gofmt -s -l .| grep -v .pb. | grep -v vendor/ | tee /dev/stderr)
+
+>&2 echo "govet..."
+test -z $(GOOS=linux go tool vet -printf=false . 2>&1 | grep -v vendor/ | tee /dev/stderr)
+
+>&2 echo "golint..."
+test -z $(find . -type f -name "*.go" -not -path "*/vendor/*" -not -name "*.pb.*" -exec golint {} \; | tee /dev/stderr)
+
+>&2 echo "ineffassign..."
+test -z $(find . -type f -name "*.go" -not -path "*/vendor/*" -not -name "*.pb.*" -exec ineffassign {} \; | tee /dev/stderr)
+
+>&2 echo "go test..."
+go test
+
+>&2 echo "go build..."
+
+export CGO_ENABLED=0
+
+if [ "$GOOS" = "darwin" -o "$GOOS" = "windows" ]
+then
+	if [ -z "$ldflags" ]
+	then
+		go install
+	else
+		go install -ldflags "${ldflags}"
+	fi
+else
+	go install -buildmode pie -ldflags "-s -w ${ldflags} -extldflags \"-fno-PIC -static\""
+fi