diff --git a/tools/toybox-media/Dockerfile b/tools/toybox-media/Dockerfile
index 64e9c1564..cc3a3da9d 100644
--- a/tools/toybox-media/Dockerfile
+++ b/tools/toybox-media/Dockerfile
@@ -1,12 +1,18 @@
-FROM linuxkit/c-compile:f52f485825c890d581e82a62af6906c1d33d8e5d@sha256:473fd283a090d3546e93915adacf00c69a23ff615c95c968c4a40e8723985853 AS toybox-build
-COPY . .
+FROM linuxkit/alpine:c5021a113803f7608e3908014d316c3490183d0b@sha256:4c7a80173c71ca5019dc56f40442b3a8345f141dd46593bd1fe6d130294d07cb AS build
+RUN apk add \
+    bash \
+    gcc \
+    git \
+    make \
+    musl-dev
+
 ENV FILES="ls tar sh find sha1sum"
 # 0.7.2
 ENV LDFLAGS=--static
 RUN git clone https://github.com/landley/toybox.git && \
-  cd toybox && git checkout b27d5d9ad0c56014d8661d91f69ee498bbbe4cf9 && \
-  make defconfig
+  cd toybox && git checkout b27d5d9ad0c56014d8661d91f69ee498bbbe4cf9
 WORKDIR /toybox
+RUN make defconfig
 RUN make ${FILES}
 RUN mkdir -p /out/bin
 RUN cp ${FILES} /out/bin
@@ -15,4 +21,4 @@ FROM scratch
 ENTRYPOINT []
 CMD []
 WORKDIR /
-COPY --from=toybox-build out/bin bin/
+COPY --from=build out/bin bin/
diff --git a/tools/toybox-media/Makefile b/tools/toybox-media/Makefile
index 115c793bc..5f00a6435 100644
--- a/tools/toybox-media/Makefile
+++ b/tools/toybox-media/Makefile
@@ -2,39 +2,13 @@
 default: push
 
 IMAGE=toybox-media
-BASE=linuxkit/c-compile:f52f485825c890d581e82a62af6906c1d33d8e5d
-SHA_IMAGE=alpine:3.5@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
-DEPS=Dockerfile Makefile
+DEPS=Dockerfile
 
-hash: $(DEPS)
-	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
-	find $^ -type f | xargs cat | docker run --rm -i $(SHA_IMAGE) sha1sum - | sed 's/ .*//' > hash
+HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
 
-tag: hash
-	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
-		(docker build --no-cache -t $(IMAGE):build . && \
-		 docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash))
+tag: $(DEPS)
+	docker build --no-cache -t linuxkit/$(IMAGE):$(HASH) .
 
 push: tag
-	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
-		docker push linuxkit/$(IMAGE):$(shell cat hash)
-	rm -f hash
-	docker rmi $(IMAGE):build || true
-
-signed-tag: hash
-	DOCKER_CONTENT_TRUST=1 docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
-		(DOCKER_CONTENT_TRUST=1 docker pull $(BASE) && \
-		 docker build --no-cache -t $(IMAGE):build . && \
-		 docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash))
-
-sign: signed-tag
-	DOCKER_CONTENT_TRUST=1 docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
-		DOCKER_CONTENT_TRUST=1 docker push linuxkit/$(IMAGE):$(shell cat hash)
-	rm -f hash
-	docker rmi $(IMAGE):build || true
-
-clean:
-	rm -f hash
-	docker rmi $(IMAGE):build || true
-
-.DELETE_ON_ERROR:
+	DOCKER_CONTENT_TRUST=1 docker pull linuxkit/$(IMAGE):$(HASH) || \
+	DOCKER_CONTENT_TRUST=1 docker push linuxkit/$(IMAGE):$(HASH)