diff --git a/kernel/Makefile b/kernel/Makefile
index b9ddfcfdb..fc4e1a6be 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -12,25 +12,21 @@
 # which is specific to a given kernel. perf packages are tagged the same way
 # kernel packages.
 
-# Git tree hash of this directory. Override to force build
-HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
 # Name and Org on Hub
 ORG?=linuxkit
 IMAGE:=kernel
 IMAGE_PERF:=kernel-perf
 
-# Add '-dirty' to hash if the repository is not clean. make does not
-# concatenate strings without spaces, so we use the documented trick
-# of replacing the space with nothing.
-DIRTY=$(shell git diff-index --quiet HEAD --; echo $$?)
-ifneq ($(DIRTY),0)
-HASH+=-dirty
-nullstring :=
-space := $(nullstring) $(nullstring)
-TAG=$(subst $(space),,$(HASH))
-else
-TAG=$(HASH)
+ifeq ($(HASH),)
+HASH_COMMIT?=HEAD # Setting this is only really useful with the show-tag target
+HASH?=$(shell git ls-tree --full-tree $(HASH_COMMIT) -- $(CURDIR) | awk '{print $$3}')
+
+ifneq ($(HASH_COMMIT),HEAD) # Others can't be dirty by definition
+DIRTY=$(shell  git update-index -q --refresh && git diff-index --quiet HEAD -- $(CURDIR) || echo "-dirty")
 endif
+endif
+
+TAG=$(HASH)$(DIRTY)
 
 .PHONY: check tag push
 # Targets:
@@ -59,14 +55,18 @@ build_$(2)$(3): Dockerfile Makefile $(wildcard patches-$(2)/*) kernel_config-$(2
 			--no-cache -t $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) .
 
 push_$(2)$(3): build_$(2)$(3)
-	@if [ $(DIRTY) -ne 0 ]; then echo "Your repository is not clean. Will not push image"; exit 1; fi
+	@if [ x"$(DIRTY)" !=  x ]; then echo "Your repository is not clean. Will not push image"; exit 1; fi
 	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) || \
 		(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) && \
 		 docker tag $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) $(ORG)/$(IMAGE):$(1)$(3) && \
 		 DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3))
 
+show-tag_$(2)$(3):
+	@echo $(ORG)/$(IMAGE):$(1)$(3)-$(TAG)
+
 build: build_$(2)$(3)
 push: push_$(2)$(3)
+show-tags: show-tag_$(2)$(3)
 
 ifneq ($(2), 4.4.x)
 build_perf_$(2)$(3): build_$(2)$(3)
@@ -76,7 +76,7 @@ build_perf_$(2)$(3): build_$(2)$(3)
 	 		--no-cache --network=none -t $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) .
 
 push_perf_$(2)$(3): build_perf_$(2)$(3)
-	@if [ $(DIRTY) -ne 0 ]; then echo "Your repository is not clean. Will not push image"; exit 1; fi
+	@if [ x"$(DIRTY)" != x ]; then echo "Your repository is not clean. Will not push image"; exit 1; fi
 	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) || \
 		(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) && \
 		 docker tag $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) $(ORG)/$(IMAGE_PERF):$(1)$(3) && \
diff --git a/pkg/Makefile b/pkg/Makefile
index 81ed81bce..47480140b 100644
--- a/pkg/Makefile
+++ b/pkg/Makefile
@@ -1,4 +1,4 @@
-DIRS = $(shell find . -type d -depth 1)
+DIRS = $(shell find . -maxdepth 1 -mindepth 1 -type d)
 .PHONY: clean dirs $(DIRS)
 
 push:
diff --git a/pkg/package.mk b/pkg/package.mk
index 85dedf645..350846778 100644
--- a/pkg/package.mk
+++ b/pkg/package.mk
@@ -1,22 +1,19 @@
-.PHONY: tag push
+.PHONY: image tag show-tag
 default: push
 
 ORG?=linuxkit
-HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
-BASE_DEPS=Dockerfile Makefile
+ifeq ($(HASH),)
+HASH_COMMIT?=HEAD # Setting this is only really useful with the show-tag target
+HASH?=$(shell git ls-tree --full-tree $(HASH_COMMIT) -- $(CURDIR) | awk '{print $$3}')
 
-# Add '-dirty' to hash if the repository is not clean. make does not
-# concatenate strings without spaces, so we use the documented trick
-# of replacing the space with nothing.
-DIRTY=$(shell git diff-index --quiet HEAD --; echo $$?)
-ifneq ($(DIRTY),0)
-HASH+=-dirty
-nullstring :=
-space := $(nullstring) $(nullstring)
-TAG=$(subst $(space),,$(HASH))
-else
-TAG=$(HASH)
+ifneq ($(HASH_COMMIT),HEAD) # Others can't be dirty by definition
+DIRTY=$(shell git update-index -q --refresh && git diff-index --quiet HEAD -- $(CURDIR) || echo "-dirty")
 endif
+endif
+
+TAG=$(ORG)/$(IMAGE):$(HASH)$(DIRTY)
+
+BASE_DEPS=Dockerfile Makefile
 
 # Get a release tag, if present
 RELEASE=$(shell git tag -l --points-at HEAD)
@@ -27,17 +24,20 @@ else
 NET_OPT=--network=none
 endif
 
+show-tag:
+	@echo $(TAG)
+
 tag: $(BASE_DEPS) $(DEPS)
-	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(TAG) || \
-	docker build $(NET_OPT) -t $(ORG)/$(IMAGE):$(TAG) .
+	DOCKER_CONTENT_TRUST=1 docker pull $(TAG) || \
+	docker build $(NET_OPT) -t $(TAG) .
 
 push: tag
-ifneq ($(DIRTY),0)
+ifneq ($(DIRTY),)
 	$(error Your repository is not clean. Will not push package image.)
 endif
-	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(TAG) || \
-	DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(TAG)
+	DOCKER_CONTENT_TRUST=1 docker pull $(TAG) || \
+	DOCKER_CONTENT_TRUST=1 docker push $(TAG)
 ifneq ($(RELEASE),)
-	docker tag $(ORG)/$(IMAGE):$(TAG) $(ORG)/$(IMAGE):$(RELEASE)	
+	docker tag $(TAG) $(ORG)/$(IMAGE):$(RELEASE)
 	DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(RELEASE)
 endif
diff --git a/tools/Makefile b/tools/Makefile
index 20c61fb08..94894d076 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -1,4 +1,4 @@
-DIRS = $(shell find . -type d -depth 1)
+DIRS = $(shell find . -maxdepth 1 -mindepth 1 -type d)
 .PHONY: clean dirs $(DIRS)
 
 push: $(DIRS)
diff --git a/tools/go-compile/Makefile b/tools/go-compile/Makefile
index 1f0995e2a..3caba19e1 100644
--- a/tools/go-compile/Makefile
+++ b/tools/go-compile/Makefile
@@ -1,15 +1,4 @@
-.PHONY: tag push
-default: push
+include ../../pkg/package.mk
 
-ORG?=linuxkit
 IMAGE=go-compile
-DEPS=Dockerfile Makefile compile.sh
-
-HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
-
-tag: $(DEPS)
-	docker build --no-cache --network=none -t $(ORG)/$(IMAGE):$(HASH) .
-
-push: tag
-	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(HASH) || \
-	DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(HASH)
+DEPS=compile.sh
diff --git a/tools/qemu/Makefile b/tools/qemu/Makefile
index 0496d8d0e..b52fa7214 100644
--- a/tools/qemu/Makefile
+++ b/tools/qemu/Makefile
@@ -1,15 +1,3 @@
-.PHONY: tag push
-default: push
+include ../../pkg/package.mk
 
-ORG?=linuxkit
 IMAGE=qemu
-DEPS=Dockerfile Makefile
-
-HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
-
-tag: $(DEPS)
-	DOCKER_CONTENT_TRUST=1 docker build --no-cache --network=none -t $(ORG)/$(IMAGE):$(HASH) .
-
-push: tag
-	docker pull $(ORG)/$(IMAGE):$(HASH) || \
-	docker push $(ORG)/$(IMAGE):$(HASH)