diff --git a/.docker-env.sample b/.docker-env.sample
new file mode 100644
index 00000000..63d11429
--- /dev/null
+++ b/.docker-env.sample
@@ -0,0 +1,2 @@
+DOCKER_HOST="tcp://192.168.2.2:2375"
+DOCKER_TLS_VERIFY=
diff --git a/.dockerignore.docker b/.dockerignore.dapper
similarity index 100%
rename from .dockerignore.docker
rename to .dockerignore.dapper
diff --git a/.drone.yml b/.drone.yml
index 6f7ea8e4..9a7fbf66 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -3,5 +3,4 @@ build:
   volumes:
   - /var/run/docker.sock:/var/run/docker.sock
   commands:
-  - dapper -O make ARCH=arm rootfs
-  - dapper -O make DEV_BUILD=1 test
+  - ./scripts/ci
diff --git a/.gitignore b/.gitignore
index f3fbff37..0d2534cd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,4 @@
 /tests/integration/.tox
 *.pyc
 __pychache__
+.docker-env.*
diff --git a/.wrap-docker-args b/.wrap-docker-args
deleted file mode 100644
index 3c1a8ef1..00000000
--- a/.wrap-docker-args
+++ /dev/null
@@ -1 +0,0 @@
---privileged
diff --git a/Dockerfile b/Dockerfile.amd64
similarity index 100%
rename from Dockerfile
rename to Dockerfile.amd64
diff --git a/Dockerfile.arm64 b/Dockerfile.arm64
new file mode 100644
index 00000000..5efe1566
--- /dev/null
+++ b/Dockerfile.arm64
@@ -0,0 +1,15 @@
+FROM aarch64/debian:jessie
+ENV DEBIAN_FRONTEND noninteractive
+ENV ARCH arm
+
+RUN apt-get update && apt-get install -y parted
+
+# TODO add kexec-tools: build from sources for aarch64
+
+COPY ./scripts/installer /scripts
+COPY ./build.conf /scripts/
+
+COPY ./dist/artifacts/vmlinuz /dist/
+COPY ./dist/artifacts/initrd  /dist/
+
+ENTRYPOINT ["/scripts/lay-down-os"]
diff --git a/Dockerfile.dapper b/Dockerfile.dapper
index 887ea0fc..e0358e42 100644
--- a/Dockerfile.dapper
+++ b/Dockerfile.dapper
@@ -1,58 +1,71 @@
-FROM ubuntu:15.10
+FROM rancher/os-dapper-base
+
+ARG ARCH
+ENV ARCH ${ARCH}
+ARG DOCKER_BINARY_URL
+ENV DOCKER_BINARY_URL ${DOCKER_BINARY_URL}
 
 RUN apt-get update && \
-    apt-get -y install locales sudo vim less curl wget git rsync build-essential syslinux isolinux xorriso \
-        libblkid-dev libmount-dev libselinux1-dev cpio genisoimage qemu-kvm python-pip ca-certificates pkg-config
+    apt-get -y install locales sudo vim less curl wget git rsync build-essential isolinux xorriso gccgo \
+        libblkid-dev libmount-dev libselinux1-dev cpio genisoimage qemu-kvm python-pip ca-certificates pkg-config tox
 
-RUN locale-gen en_US.UTF-8
-ENV LANG en_US.UTF-8
-ENV PATH $PATH:/usr/local/go/bin
+RUN mkdir -p /usr/local && cd /usr/local && \
+    wget -O - https://storage.googleapis.com/golang/go1.6.src.tar.gz | tar -xz && \
+    cd go/src && GOROOT_BOOTSTRAP=/usr GOARCH=${ARCH} GOHOSTARCH=${ARCH} ./make.bash
+
+ENV PATH /usr/local/go/bin:$PATH
 RUN mkdir -p /go/src /go/bin && chmod -R 777 /go
 ENV GOPATH /go
 ENV PATH /go/bin:$PATH
 
-RUN pip install tox
-RUN curl -sSL https://storage.googleapis.com/golang/go1.6.linux-amd64.tar.gz | tar -xz -C /usr/local
-RUN curl -sL https://get.docker.com/builds/Linux/x86_64/docker-1.10.2 > /usr/local/bin/docker
+RUN wget -O - ${DOCKER_BINARY_URL} > /usr/local/bin/docker
 RUN chmod +x /usr/local/bin/docker
 
 ENV DAPPER_DOCKER_SOCKET true
 ENV DAPPER_SOURCE /go/src/github.com/rancher/os
-ENV DAPPER_OUTPUT ./bin ./dist
+ENV DAPPER_OUTPUT ./bin ./dist ./build/os-config.yml
 ENV DAPPER_RUN_ARGS --privileged
 ENV SHELL /bin/bash
 WORKDIR ${DAPPER_SOURCE}
 
-COPY .dockerignore.docker .dockerignore
+COPY .dockerignore.dapper .dockerignore
 
-RUN cd /usr/local/src && \
-    for i in libselinux pcre3 util-linux; do \
-        apt-get build-dep -y $i && \
-        apt-get source -y $i \
-    ;done
+CMD make
 
-RUN apt-get install -y gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf
-RUN cd /usr/local/src/pcre3-* && \
-    autoreconf && \
-    CC=arm-linux-gnueabihf-gcc CXX=arm-linux-gnueabihf-g++ ./configure --host=arm-linux-gnueabihf --prefix=/usr/arm-linux-gnueabihf && \
-    make -j$(nproc) && \
-    make install
+ARG TOOLCHAIN
+ENV TOOLCHAIN ${TOOLCHAIN}
 
-RUN cd /usr/local/src/libselinux-* && \
-    CC=arm-linux-gnueabihf-gcc CXX=arm-linux-gnueabihf-g++ make CFLAGS=-Wall && \
-    make PREFIX=/usr/arm-linux-gnueabihf DESTDIR=/usr/arm-linux-gnueabihf install
+RUN if [ "${TOOLCHAIN}" != "" ]; then \
+        cd /usr/local/src && \
+        for i in libselinux pcre3 util-linux; do \
+            apt-get build-dep -y $i && \
+            apt-get source -y $i \
+        ;done \
+     ;fi
 
-RUN cd /usr/local/src/util-linux-* && \
-    autoreconf && \
-    CC=arm-linux-gnueabihf-gcc CXX=arm-linux-gnueabihf-g++ ./configure --host=arm-linux-gnueabihf --prefix=/usr/arm-linux-gnueabihf \
-        --disable-all-programs \
-        --enable-libmount \
-        --enable-libblkid \
-        --enable-libuuid \
-        --enable-mount && \
-    make -j$(nproc) && \
-    make install
+RUN if [ "${TOOLCHAIN}" != "" ]; then \
+        cd /usr/local/src/pcre3-* && \
+        autoreconf && \
+        CC=${TOOLCHAIN}-gcc CXX=${TOOLCHAIN}-g++ ./configure --host=${TOOLCHAIN} --prefix=/usr/${TOOLCHAIN} && \
+        make -j$(nproc) && \
+        make install \
+    ;fi
 
-CMD make all
+RUN if [ "${TOOLCHAIN}" != "" ]; then \
+        cd /usr/local/src/libselinux-* && \
+        CC=${TOOLCHAIN}-gcc CXX=${TOOLCHAIN}-g++ make CFLAGS=-Wall && \
+        make PREFIX=/usr/${TOOLCHAIN} DESTDIR=/usr/${TOOLCHAIN} install \
+    ;fi
 
-ENV DAPPER_OUTPUT ./bin ./dist ./build/os-config.yml
+RUN if [ "${TOOLCHAIN}" != "" ]; then \
+        cd /usr/local/src/util-linux-* && \
+        autoreconf && \
+        CC=${TOOLCHAIN}-gcc CXX=${TOOLCHAIN}-g++ ./configure --host=${TOOLCHAIN} --prefix=/usr/${TOOLCHAIN} \
+            --disable-all-programs \
+            --enable-libmount \
+            --enable-libblkid \
+            --enable-libuuid \
+            --enable-mount && \
+        make -j$(nproc) && \
+        make install \
+    ;fi
diff --git a/Makefile b/Makefile
index edb7b85d..65b74433 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,7 @@
 FORCE_PULL := 0
 DEV_BUILD  := 0
 ARCH       := amd64
+SUFFIX := $(if $(filter-out amd64,$(ARCH)),_$(ARCH))
 
 include build.conf
 include build.conf.$(ARCH)
@@ -12,11 +13,7 @@ bin/ros:
 
 build/host_ros: bin/ros
 	mkdir -p $(dir $@)
-ifeq "$(ARCH)" "amd64"
 	ln -sf ../bin/ros $@
-else
-	ARCH=amd64 VERSION=$(VERSION) ./scripts/mk-ros.sh $@
-endif
 
 
 assets/docker:
@@ -31,11 +28,11 @@ assets/selinux/policy.29:
 ifdef COMPILED_KERNEL_URL
 
 installer: minimal
-	docker build -t $(IMAGE_NAME):$(VERSION) .
+	docker build -t $(IMAGE_NAME):$(VERSION)$(SUFFIX) -f Dockerfile.$(ARCH) .
 
 dist/artifacts/vmlinuz: build/kernel/
 	mkdir -p $(dir $@)
-	mv build/kernel/boot/vmlinuz* $@
+	mv $(or $(wildcard build/kernel/boot/vmlinuz*), $(wildcard build/kernel/boot/vmlinux*)) $@
 
 
 build/kernel/:
diff --git a/build.conf.amd64 b/build.conf.amd64
index bc92e52c..79fa82e1 100644
--- a/build.conf.amd64
+++ b/build.conf.amd64
@@ -1,2 +1,5 @@
+DAPPER_BASE=ubuntu:16.04
+TOOLCHAIN= #empty
+
 COMPILED_KERNEL_URL=https://github.com/rancher/os-kernel/releases/download/Ubuntu-4.2.0-28.33-rancher/linux-4.2.8-ckt3-rancher-x86.tar.gz
 DOCKER_BINARY_URL=https://get.docker.com/builds/Linux/x86_64/docker-1.10.2
diff --git a/build.conf.arm b/build.conf.arm
index 9f64d3d8..ea905e66 100644
--- a/build.conf.arm
+++ b/build.conf.arm
@@ -1 +1,4 @@
-DOCKER_BINARY_URL=https://github.com/rancher/docker/releases/download/v1.10.2-ros_arm/docker-1.10.2
+DAPPER_BASE=armhf/ubuntu:16.04
+TOOLCHAIN=arm-linux-gnueabihf
+
+DOCKER_BINARY_URL=https://github.com/rancher/docker/releases/download/v1.10.2-arm2/docker-1.10.2_arm
diff --git a/build.conf.arm64 b/build.conf.arm64
new file mode 100644
index 00000000..d2367db9
--- /dev/null
+++ b/build.conf.arm64
@@ -0,0 +1,5 @@
+DAPPER_BASE=aarch64/ubuntu:16.04
+TOOLCHAIN=aarch64-linux-gnu
+
+DOCKER_BINARY_URL=https://github.com/rancher/docker/releases/download/v1.10.2-arm2/docker-1.10.2_arm64
+COMPILED_KERNEL_URL=https://github.com/imikushin/os-kernel/releases/download/Estuary-4.1.18-arm64/linux-4.1.18-arm64.tar.gz
diff --git a/build.sh b/build.sh
index 8ca7cf59..00abad72 100755
--- a/build.sh
+++ b/build.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 set -e
 
+export ARCH=${ARCH:-amd64}
+
+cd $(dirname $0)
+
 if [ "$1" != "--dev" ]; then
   echo
   echo Running \"production\" build. Will use lzma to compress initrd, which is somewhat slow...
@@ -8,10 +12,9 @@ if [ "$1" != "--dev" ]; then
   echo
   echo For \"developer\" builds, run ./build.sh --dev
   echo
-  dapper make all
+  ./scripts/make.sh all
 else
-  dapper make DEV_BUILD=1 all
+  ./scripts/make.sh DEV_BUILD=1 all
 fi
 
-
 ls -lh dist/artifacts
diff --git a/scripts/ci b/scripts/ci
index cacce980..4b2bcd7b 100755
--- a/scripts/ci
+++ b/scripts/ci
@@ -1,7 +1,7 @@
-#!/bin/bash
+#!/bin/sh
 set -ex
 
 cd $(dirname $0)/..
+. ./scripts/dapper-common
 
-dapper -O make ARCH=arm rootfs
-dapper -O make DEV_BUILD=1 test
+dapper -d -O make ARCH=${ARCH} DEV_BUILD=1 test
diff --git a/scripts/dapper-common b/scripts/dapper-common
new file mode 100755
index 00000000..64bda766
--- /dev/null
+++ b/scripts/dapper-common
@@ -0,0 +1,21 @@
+#!/bin/sh
+set -ex
+
+guessArch() {
+  docker version | grep 'OS/Arch:' | tail -n+2 | awk '{print $2}' | cut -f2 -d'/'
+}
+
+ARCH=${ARCH:-"$(guessArch)"}
+ARCH=${ARCH:?"Failed to guess ARCH"}
+export ARCH
+
+cd $(dirname $0)/..
+
+[ -f "./.docker-env.${ARCH}" ] && . ./.docker-env.${ARCH} || echo "WARNING: missing .docker-env.${ARCH} (to use an ${ARCH} docker host)"
+
+set -a
+. ./build.conf.${ARCH}
+set +a
+
+docker inspect $DAPPER_BASE >/dev/null 2>&1 || docker pull $DAPPER_BASE
+docker tag $DAPPER_BASE rancher/os-dapper-base
diff --git a/scripts/installer/lay-down-os b/scripts/installer/lay-down-os
index cae0414a..b6a80a8c 100755
--- a/scripts/installer/lay-down-os
+++ b/scripts/installer/lay-down-os
@@ -21,6 +21,7 @@ do
         *) exit 1 ;;
     esac
 done
+[ "$ARCH" == "arm" && "$ENV" != "rancher-upgrade" ] && ENV=arm
 
 DIST=${DIST:-/dist}
 CLOUD_CONFIG=${CLOUD_CONFIG:-"${SCRIPTS_DIR}/conf/empty.yml"}
@@ -153,6 +154,10 @@ if [ -n ${ENV} ]; then
             install_grub
             "${SCRIPTS_DIR}/seed-data" ${BASE_DIR} ${CLOUD_CONFIG} ${FILES}
             ;;
+        "arm")
+            format_and_mount
+            "${SCRIPTS_DIR}/seed-data" ${BASE_DIR} ${CLOUD_CONFIG} ${FILES}
+            ;;
         "amazon-ebs-pv"|"amazon-ebs-hvm")
             CONSOLE=ttyS0
             format_and_mount
diff --git a/scripts/make.sh b/scripts/make.sh
new file mode 100755
index 00000000..b040e471
--- /dev/null
+++ b/scripts/make.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+set -e
+
+cd $(dirname $0)/..
+. ./scripts/dapper-common
+
+dapper make ARCH=${ARCH} "$@"
diff --git a/scripts/mk-initrd.sh b/scripts/mk-initrd.sh
index 021a2fd7..9f34f1b7 100755
--- a/scripts/mk-initrd.sh
+++ b/scripts/mk-initrd.sh
@@ -3,7 +3,7 @@ set -ex
 
 TARGET=$(pwd)/${1}
 
-ARCH=${ARCH:-"amd64"}
+ARCH=${ARCH:?"ARCH not set"}
 DFS_IMAGE=${DFS_IMAGE:?"DFS_IMAGE not set"}
 IS_ROOTFS=${IS_ROOTFS:-0}
 
@@ -53,12 +53,12 @@ docker export ${DFS_ARCH} | tar xvf - -C ${INITRD_DIR} --exclude=usr/bin/dockerl
                                                        usr
 
 if [ "$IS_ROOTFS" == "1" ]; then
-  DFS=$(docker run -d --privileged -v /lib/modules/$(uname -r):/lib/modules/$(uname -r) ${DFS_IMAGE})
+  DFS=$(docker run -d --privileged -v /lib/modules/$(uname -r):/lib/modules/$(uname -r) ${DFS_ARCH_IMAGE})
   trap "docker rm -fv ${DFS_ARCH} ${DFS}" EXIT
   docker exec -i ${DFS} docker load < ${BUILD}/images.tar
   docker stop ${DFS}
-  docker run --rm --volumes-from=${DFS} debian:jessie tar -c -C /var/lib/docker ./image | tar -x -C ${INITRD_DIR}/var/lib/system-docker
-  docker run --rm --volumes-from=${DFS} debian:jessie tar -c -C /var/lib/docker ./overlay | tar -x -C ${INITRD_DIR}/var/lib/system-docker
+  docker run --rm --volumes-from=${DFS} rancher/os-dapper-base tar -c -C /var/lib/docker ./image | tar -x -C ${INITRD_DIR}/var/lib/system-docker
+  docker run --rm --volumes-from=${DFS} rancher/os-dapper-base tar -c -C /var/lib/docker ./overlay | tar -x -C ${INITRD_DIR}/var/lib/system-docker
 
   cd ${INITRD_DIR}
 
diff --git a/scripts/mk-ros.sh b/scripts/mk-ros.sh
index 2a538f2e..6f32d6af 100755
--- a/scripts/mk-ros.sh
+++ b/scripts/mk-ros.sh
@@ -8,12 +8,6 @@ VERSION=${VERSION:?"VERSION not set"}
 
 cd $(dirname $0)/..
 
-strip_bin=$(which strip)
-if [ "${ARCH}" == "arm" ]; then
-  export GOARM=6
-  export CC=/usr/bin/arm-linux-gnueabihf-gcc
-  export CGO_ENABLED=1
-  strip_bin=/usr/arm-linux-gnueabihf/bin/strip
-fi
+[ "${ARCH}" == "arm" ] && export GOARM=6
 GOARCH=${ARCH} go build -tags netgo -installsuffix netgo -ldflags "-X github.com/rancher/os/config.VERSION=${VERSION} -linkmode external -extldflags -static" -o ${ros}
-${strip_bin} --strip-all ${ros}
+strip --strip-all ${ros}
diff --git a/scripts/run b/scripts/run
index ea02a74c..c7ee2281 100755
--- a/scripts/run
+++ b/scripts/run
@@ -7,6 +7,9 @@ cd $(dirname $0)/..
 source scripts/build-common
 
 BASE=$(pwd)
+UNAME=$(uname)
+QEMUARCH=$(uname -m)
+[ "${UNAME}" == "Darwin" ] && QEMUARCH=x86_64
 
 KERNEL=${BASE}/dist/artifacts/vmlinuz
 INITRD=${BASE}/dist/artifacts/initrd
@@ -41,7 +44,7 @@ while [ "$#" -gt 0 ]; do
             fi
             ;;
         --qemu)
-            if [ -x $(which qemu-system-x86_64) ]; then
+            if [ -x $(which qemu-system-${QEMUARCH}) ]; then
                 QEMU=1
             fi
             ;;
@@ -76,7 +79,6 @@ if [[ ! -e ${KERNEL} || ! -e ${INITRD} ]]; then
     exit 1
 fi
 
-UNAME=$(uname)
 # Linux and Darwin SHA1 sum binary are different, pick which to use
 if [ "$UNAME" == "Darwin" ]; then sha1sum=$(which shasum)
 elif [ "$UNAME" == "Linux" ]; then sha1sum=$(which sha1sum);
@@ -102,7 +104,7 @@ if [ "$REBUILD" == "1" ]; then
 
     mkdir -p ${INITRD_TMP}/usr/{bin,share/ros}
     cp bin/ros ${INITRD_TMP}/usr/bin/
-    cp -f os-config.yml ${INITRD_TMP}/usr/share/ros/ #FIXME: generate os-config.yml from os-config.tpl.yml
+    cp -f build/os-config.yml ${INITRD_TMP}/usr/share/ros/
 
     pushd ${INITRD_TMP}
     find . | cpio -H newc -o | gzip > ${INITRD_TEST}
@@ -166,7 +168,7 @@ if [ "$XHYVE" == "1" ] || [ "$QEMU" == "1" ]; then
         if [ "$KVM" == "1" ]; then
             KVM_ENABLE="-machine accel=kvm -cpu host"
         fi
-        exec qemu-system-x86_64 -serial stdio \
+        exec qemu-system-${QEMUARCH} -serial stdio \
             -kernel ${KERNEL} \
             -initrd ${INITRD} \
             -m 1024 \
diff --git a/selinux/selinux_linux_arm64.go b/selinux/selinux_linux_arm64.go
new file mode 100644
index 00000000..ab4b38b0
--- /dev/null
+++ b/selinux/selinux_linux_arm64.go
@@ -0,0 +1,6 @@
+package selinux
+
+// InitializeSelinux is a stub for SELinux support on ARM64
+func InitializeSelinux() (int, error) {
+	return 0, nil
+}
diff --git a/util/cutil.go b/util/cutil.go
index ac770ef7..07d58b6f 100644
--- a/util/cutil.go
+++ b/util/cutil.go
@@ -3,7 +3,7 @@
 package util
 
 /*
-#cgo LDFLAGS: -lmount -lblkid -luuid -lselinux
+#cgo LDFLAGS: -lmount -lblkid -luuid
 #include<blkid/blkid.h>
 #include<libmount/libmount.h>
 #include<stdlib.h>
@@ -34,10 +34,3 @@ func GetFsType(device string) (string, error) {
 	}
 	return "", errors.New("Error while getting fstype")
 }
-
-func intToBool(value C.int) bool {
-	if value == 0 {
-		return false
-	}
-	return true
-}