diff --git a/Makefile b/Makefile
index 43bd1b38cb..250bbd41a3 100644
--- a/Makefile
+++ b/Makefile
@@ -159,16 +159,6 @@ UPUP_MODELS_BINDATA_SOURCES:=$(shell find upup/models/cloudup)
 upup/models/bindata.go: ${UPUP_MODELS_BINDATA_SOURCES}
 	make update-bindata
 
-# Build in a docker container with golang 1.X
-# Used to test we have not broken 1.X
-.PHONY: check-builds-in-go112
-check-builds-in-go112:
-	docker run -e GO111MODULE=on -e EXTRA_BUILDFLAGS=-mod=vendor -v ${KOPS_ROOT}:/go/src/k8s.io/kops golang:1.12 make -C /go/src/k8s.io/kops all
-
-.PHONY: check-builds-in-go113
-check-builds-in-go113:
-	docker run -e EXTRA_BUILDFLAGS=-mod=vendor -v ${KOPS_ROOT}:/go/src/k8s.io/kops golang:1.13 make -C /go/src/k8s.io/kops all
-
 .PHONY: codegen
 codegen: kops-gobindata
 	go install k8s.io/kops/upup/tools/generators/...
@@ -212,22 +202,6 @@ crossbuild-nodeup-arm64: ${DIST}/linux/arm64/nodeup
 .PHONY: crossbuild-nodeup
 crossbuild-nodeup: crossbuild-nodeup-amd64 crossbuild-nodeup-arm64
 
-.PHONY: crossbuild-nodeup-in-docker
-crossbuild-nodeup-in-docker:
-	docker pull golang:${GOVERSION} # Keep golang image up to date
-	docker run --name=nodeup-build-${UNIQUE} -e STATIC_BUILD=yes -e VERSION=${VERSION} -v ${KOPS_ROOT}:/go/src/k8s.io/kops golang:${GOVERSION} make -C /go/src/k8s.io/kops/ crossbuild-nodeup
-	docker start nodeup-build-${UNIQUE}
-	docker exec nodeup-build-${UNIQUE} chown -R ${UID}:${GID} /go/src/k8s.io/kops/.build
-	docker cp nodeup-build-${UNIQUE}:/go/src/k8s.io/kops/.build .
-	docker kill nodeup-build-${UNIQUE}
-	docker rm nodeup-build-${UNIQUE}
-
-.PHONY: nodeup-dist
-nodeup-dist: crossbuild-nodeup-in-docker
-	mkdir -p ${DIST}
-	tools/sha256 ${DIST}/linux/amd64/nodeup ${DIST}/linux/amd64/nodeup.sha256
-	tools/sha256 ${DIST}/linux/arm64/nodeup ${DIST}/linux/arm64/nodeup.sha256
-
 .PHONY: ${DIST}/darwin/amd64/kops
 ${DIST}/darwin/amd64/kops: ${BINDATA_TARGETS}
 	mkdir -p ${DIST}
@@ -251,51 +225,13 @@ ${DIST}/windows/amd64/kops.exe: ${BINDATA_TARGETS}
 .PHONY: crossbuild
 crossbuild: ${DIST}/windows/amd64/kops.exe ${DIST}/darwin/amd64/kops ${DIST}/linux/amd64/kops ${DIST}/linux/arm64/kops
 
-.PHONY: crossbuild-in-docker
-crossbuild-in-docker:
-	docker pull golang:${GOVERSION} # Keep golang image up to date
-	docker run --name=kops-build-${UNIQUE} -e STATIC_BUILD=yes -e VERSION=${VERSION} -v ${KOPS_ROOT}:/go/src/k8s.io/kops golang:${GOVERSION} make -C /go/src/k8s.io/kops/ crossbuild
-	docker start kops-build-${UNIQUE}
-	docker exec kops-build-${UNIQUE} chown -R ${UID}:${GID} /go/src/k8s.io/kops/.build
-	docker cp kops-build-${UNIQUE}:/go/src/k8s.io/kops/.build .
-	docker kill kops-build-${UNIQUE}
-	docker rm kops-build-${UNIQUE}
-
-.PHONY: kops-dist
-kops-dist: crossbuild-in-docker
-	mkdir -p ${DIST}
-	tools/sha256 ${DIST}/darwin/amd64/kops ${DIST}/darwin/amd64/kops.sha256
-	tools/sha256 ${DIST}/linux/amd64/kops ${DIST}/linux/amd64/kops.sha256
-	tools/sha256 ${DIST}/linux/arm64/kops ${DIST}/linux/arm64/kops.sha256
-	tools/sha256 ${DIST}/windows/amd64/kops.exe ${DIST}/windows/amd64/kops.exe.sha256
-
-.PHONY: version-dist
-version-dist: nodeup-dist kops-dist protokube-export
-	rm -rf ${UPLOAD}
-	mkdir -p ${UPLOAD}/kops/${VERSION}/linux/amd64/
-	mkdir -p ${UPLOAD}/kops/${VERSION}/linux/arm64/
-	mkdir -p ${UPLOAD}/kops/${VERSION}/darwin/amd64/
-	mkdir -p ${UPLOAD}/kops/${VERSION}/images/
-	cp ${DIST}/linux/amd64/nodeup ${UPLOAD}/kops/${VERSION}/linux/amd64/nodeup
-	cp ${DIST}/linux/amd64/nodeup.sha256 ${UPLOAD}/kops/${VERSION}/linux/amd64/nodeup.sha256
-	cp ${DIST}/linux/arm64/nodeup ${UPLOAD}/kops/${VERSION}/linux/arm64/nodeup
-	cp ${DIST}/linux/arm64/nodeup.sha256 ${UPLOAD}/kops/${VERSION}/linux/arm64/nodeup.sha256
-	cp ${IMAGES}/protokube.tar.gz ${UPLOAD}/kops/${VERSION}/images/protokube.tar.gz
-	cp ${IMAGES}/protokube.tar.gz.sha256 ${UPLOAD}/kops/${VERSION}/images/protokube.tar.gz.sha256
-	cp ${DIST}/linux/amd64/kops ${UPLOAD}/kops/${VERSION}/linux/amd64/kops
-	cp ${DIST}/linux/amd64/kops.sha256 ${UPLOAD}/kops/${VERSION}/linux/amd64/kops.sha256
-	cp ${DIST}/linux/arm64/kops ${UPLOAD}/kops/${VERSION}/linux/arm64/kops
-	cp ${DIST}/linux/arm64/kops.sha256 ${UPLOAD}/kops/${VERSION}/linux/arm64/kops.sha256
-	cp ${DIST}/darwin/amd64/kops ${UPLOAD}/kops/${VERSION}/darwin/amd64/kops
-	cp ${DIST}/darwin/amd64/kops.sha256 ${UPLOAD}/kops/${VERSION}/darwin/amd64/kops.sha256
-
 .PHONY: upload
-upload: version-dist # Upload kops to S3
+upload: bazel-version-dist # Upload kops to S3
 	aws s3 sync --acl public-read ${UPLOAD}/ ${S3_BUCKET}
 
 # oss-upload builds kops and uploads to OSS
 .PHONY: oss-upload
-oss-upload: version-dist
+oss-upload: bazel-version-dist
 	@echo "== Uploading kops =="
 	aliyun oss cp --acl public-read -r -f --include "*" ${UPLOAD}/ ${OSS_BUCKET}
 
@@ -402,32 +338,6 @@ ${PROTOKUBE}:
 .PHONY: protokube
 protokube: ${PROTOKUBE}
 
-.PHONY: protokube-builder-image
-protokube-builder-image:
-	docker build -t protokube-builder images/protokube-builder
-
-.PHONY: protokube-build-in-docker
-protokube-build-in-docker: protokube-builder-image
-	mkdir -p ${IMAGES} # We have to create the directory first, so docker doesn't mess up the ownership of the dir
-	docker run -t -e VERSION=${VERSION} -e HOST_UID=${UID} -e HOST_GID=${GID} -v `pwd`:/src protokube-builder /onbuild.sh
-
-.PHONY: protokube-image
-protokube-image: protokube-build-in-docker
-	docker build -t protokube:${PROTOKUBE_TAG} -f images/protokube/Dockerfile .
-
-.PHONY: protokube-export
-protokube-export: protokube-image
-	docker save protokube:${PROTOKUBE_TAG} > ${IMAGES}/protokube.tar
-	gzip --no-name --force --best ${IMAGES}/protokube.tar
-	tools/sha256 ${IMAGES}/protokube.tar.gz ${IMAGES}/protokube.tar.gz.sha256
-
-# protokube-push is no longer used (we upload a docker image tar file to S3 instead),
-# but we're keeping it around in case it is useful for development etc
-.PHONY: protokube-push
-protokube-push: protokube-image
-	docker tag protokube:${PROTOKUBE_TAG} ${DOCKER_REGISTRY}/protokube:${PROTOKUBE_TAG}
-	docker push ${DOCKER_REGISTRY}/protokube:${PROTOKUBE_TAG}
-
 .PHONY: nodeup
 nodeup: ${NODEUP}
 
@@ -661,7 +571,7 @@ bazel-crossbuild-protokube:
 
 .PHONY: bazel-crossbuild-protokube-image
 bazel-crossbuild-protokube-image:
-	bazel build ${BAZEL_CONFIG} --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 //images:protokube.tar
+	bazel build ${BAZEL_CONFIG} --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 //protokube/cmd/protokube:image-bundle.tar
 
 .PHONY: bazel-crossbuild-node-authorizer-image
 bazel-crossbuild-node-authorizer-image:
@@ -713,9 +623,9 @@ push-node-authorizer:
 .PHONY: bazel-protokube-export
 bazel-protokube-export:
 	mkdir -p ${BAZELIMAGES}
-	bazel build ${BAZEL_CONFIG} --action_env=PROTOKUBE_TAG=${PROTOKUBE_TAG} --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 //images:protokube.tar.gz //images:protokube.tar.gz.sha256
-	cp -fp bazel-bin/images/protokube.tar.gz ${BAZELIMAGES}/protokube.tar.gz
-	cp -fp bazel-bin/images/protokube.tar.gz.sha256 ${BAZELIMAGES}/protokube.tar.gz.sha256
+	bazel build ${BAZEL_CONFIG} --action_env=PROTOKUBE_TAG=${PROTOKUBE_TAG} --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 //protokube/cmd/protokube:image-bundle.tar.gz //protokube/cmd/protokube:image-bundle.tar.gz.sha256
+	cp -fp bazel-bin/protokube/cmd/protokube/image-bundle.tar.gz ${BAZELIMAGES}/protokube.tar.gz
+	cp -fp bazel-bin/protokube/cmd/protokube/image-bundle.tar.gz.sha256 ${BAZELIMAGES}/protokube.tar.gz.sha256
 
 .PHONY: bazel-kube-apiserver-healthcheck-export
 bazel-kube-apiserver-healthcheck-export:
diff --git a/docker/Dockerfile b/docker/Dockerfile
deleted file mode 100644
index f9fdf212f5..0000000000
--- a/docker/Dockerfile
+++ /dev/null
@@ -1,57 +0,0 @@
-# Copyright 2019 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-FROM alpine:3.8
-
-ARG GO_VERSION=1.14.5
-
-# KOPS_GITISH: Modify to build at an explicit tag/gitish
-ARG KOPS_GITISH=release
-
-# KUBECTL_SOURCE: Change to kubernetes-dev/ci for CI
-ARG KUBECTL_SOURCE=kubernetes-release/release
-
-# KUBECTL_TRACK: Currently latest from KUBECTL_SOURCE. Change to latest-1.3.txt, etc. if desired.
-ARG KUBECTL_TRACK=stable.txt
-
-ARG KUBECTL_ARCH=linux/amd64
-
-RUN set -ex && \
-        apk add --no-cache --virtual build-dependencies curl jq git bash gcc musl-dev openssl go make && \
-        apk add  --no-cache vim ca-certificates &&\
-        \
-        export GOROOT_BOOTSTRAP="$(go env GOROOT)" && \
-        curl -L https://golang.org/dl/go${GO_VERSION}.src.tar.gz | tar zx -C /usr/local && \
-        cd /usr/local/go/src && \
-        ./make.bash && \
-        mkdir -p /go && \
-        export GOPATH=/go && \
-        \
-        go get -d k8s.io/kops && \
-        cd ${GOPATH}/src/k8s.io/kops/ && \
-        git checkout ${KOPS_GITISH} && \
-        make SHASUMCMD=0 && \
-        mv ${GOPATH}/bin/kops /usr/bin/. && \
-        \
-        KUBECTL_VERSION=$(curl -SsL --retry 5 "https://storage.googleapis.com/${KUBECTL_SOURCE}/${KUBECTL_TRACK}") && \
-        curl -SsL --retry 5 "https://storage.googleapis.com/${KUBECTL_SOURCE}/${KUBECTL_VERSION}/bin/${KUBECTL_ARCH}/kubectl" > /usr/bin/kubectl && \
-        chmod +x /usr/bin/kubectl &&\
-        \
-        rm -rf /go /usr/local/go && \
-        apk del build-dependencies && \
-        rm -rf /var/cache/apk/* && \
-        \
-        echo "=== Built kops at ${KOPS_GITISH}, fetched kubectl ${KUBECTL_VERSION} ==="
-
-ENTRYPOINT ["/usr/bin/kops"]
diff --git a/docker/Dockerfile-light b/docker/Dockerfile-light
deleted file mode 100644
index 2c37d94f28..0000000000
--- a/docker/Dockerfile-light
+++ /dev/null
@@ -1,34 +0,0 @@
-# Copyright 2017 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-FROM alpine:3.6
-
-# KUBECTL_SOURCE: Change to kubernetes-dev/ci for CI
-ARG KUBECTL_SOURCE=kubernetes-release/release
-
-# KUBECTL_TRACK: Currently latest from KUBECTL_SOURCE. Change to latest-1.3.txt, etc. if desired.
-ARG KUBECTL_TRACK=stable.txt
-
-ARG KUBECTL_ARCH=linux/amd64
-
-RUN apk add --no-cache --update ca-certificates vim curl jq && \
-    KOPS_URL=$(curl -s https://api.github.com/repos/kubernetes/kops/releases/latest | jq -r ".assets[] | select(.name == \"kops-linux-amd64\") | .browser_download_url") && \
-    curl -SsL --retry 5 "${KOPS_URL}" > /usr/local/bin/kops && \
-    chmod +x /usr/local/bin/kops && \
-    KUBECTL_VERSION=$(curl -SsL --retry 5 "https://storage.googleapis.com/${KUBECTL_SOURCE}/${KUBECTL_TRACK}") && \
-    curl -SsL --retry 5 "https://storage.googleapis.com/${KUBECTL_SOURCE}/${KUBECTL_VERSION}/bin/${KUBECTL_ARCH}/kubectl" > /usr/local/bin/kubectl && \
-    chmod +x /usr/local/bin/kubectl &&\
-    apk del curl jq
-
-ENTRYPOINT ["/usr/local/bin/kops"]
diff --git a/docker/README.md b/docker/README.md
deleted file mode 100644
index e60687bf8b..0000000000
--- a/docker/README.md
+++ /dev/null
@@ -1,27 +0,0 @@
-# Running Kops in Docker
-
-The Dockerfile here is offered primarily as a way to build continuous
-integration versions of `kops` until we figure out how we want to
-release/package it.
-
-To use it, e.g. (assumes your `$HOME` is correct and that `$KOPS_STATE_STORE` is correct):
-```shell
-docker build -t kops .
-KOPS="docker run -v $HOME/.aws:/root/.aws:ro -v $HOME/.ssh:/root/.ssh:ro -v $HOME/.kube:/root/.kube -it kops --state=$KOPS_STATE_STORE"
-```
-
-This creates a shell variable that runs the `kops` container with `~/.aws` mounted in (for AWS credentials), `~/.ssh` mounted in (for SSH keys, for AWS specifically), and `~/.kube` mounted in (so `kubectl` can add newly created clusters).
-
-After this, you can just use `$KOPS` where you would generally use `kops`, e.g. `$KOPS get cluster`.
-
-#### Choose branch/release to build.
-By default, the current release branch is built.  To build using a specific tag or commit, add the flag `--build-arg KOPS_GITISH=<tag/branch/sha>` to `docker build`, e.g. `docker build --build-arg KOPS_GITISH=release-1.6 -t kops .`
-
-#### Light Version
-The light version downloads the latest release binaries of kops from [Github Releases](https://github.com/kubernetes/kops/releases).
-
-To build the lighter version:
-```shell
-docker build -t kops:light -f Dockerfile-light .
-KOPS="docker run -v $HOME/.aws:/root/.aws:ro -v $HOME/.ssh:/root/.ssh:ro -v $HOME/.kube:/root/.kube -it kops:light --state=$KOPS_STATE_STORE"
-```
diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index 847663c561..4e9ab40fcd 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -17,6 +17,4 @@
 ./hooks/nvidia-device-plugin/image/files/nvidia-device-plugin.sh
 ./hooks/nvidia-device-plugin/image/run.sh
 ./hooks/prepull-images/image/run.sh
-./images/dns-controller-builder/onbuild.sh
-./images/protokube-builder/onbuild.sh
 ./tools/get_workspace_status.sh
diff --git a/images/BUILD.bazel b/images/BUILD.bazel
deleted file mode 100644
index e814143303..0000000000
--- a/images/BUILD.bazel
+++ /dev/null
@@ -1,50 +0,0 @@
-package(default_visibility = ["//visibility:public"])
-
-load(
-    "@io_bazel_rules_docker//container:container.bzl",
-    "container_image",
-    "container_bundle",
-)
-
-container_image(
-    name = "protokube-image",
-    base = "@distroless_base//image",
-    cmd = ["/protokube"],
-    files = [
-        "//channels/cmd/channels",
-        "//protokube/cmd/protokube",
-    ],
-    stamp = True,
-)
-
-container_bundle(
-    name = "protokube",
-    images = {
-        "protokube:{STABLE_PROTOKUBE_TAG}": "protokube-image",
-    },
-)
-
-load("//tools:gzip.bzl", "gzip")
-
-gzip(
-    name = "protokube.tar.gz",
-    src = "protokube.tar",
-)
-
-load("//tools:hashes.bzl", "hashes")
-
-hashes(
-    name = "protokube.tar.gz.hashes",
-    src = "protokube.tar.gz",
-)
-
-container_image(
-    name = "kops-controller",
-    base = "@distroless_base//image",
-    cmd = ["/usr/bin/kops-controller"],
-    directory = "/usr/bin/",
-    files = [
-        "//cmd/kops-controller",
-    ],
-    stamp = True,
-)
diff --git a/images/dns-controller-builder/Dockerfile b/images/dns-controller-builder/Dockerfile
deleted file mode 100644
index eedd25cf93..0000000000
--- a/images/dns-controller-builder/Dockerfile
+++ /dev/null
@@ -1,30 +0,0 @@
-# Copyright 2019 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-FROM k8s.gcr.io/debian-base-amd64:0.3
-
-# Install packages:
-#  curl (to download golang)
-#  git (for getting the current head)
-#  gcc make (for compilation)
-RUN apt-get update && apt-get install --yes --reinstall lsb-base \
-  && apt-get install --yes curl git gcc make bash \
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
-
-# Install golang
-RUN curl -L https://storage.googleapis.com/golang/go1.14.5.linux-amd64.tar.gz | tar zx -C /usr/local
-ENV PATH $PATH:/usr/local/go/bin
-
-COPY onbuild.sh /onbuild.sh
diff --git a/images/dns-controller-builder/onbuild.sh b/images/dns-controller-builder/onbuild.sh
deleted file mode 100755
index 841dd32436..0000000000
--- a/images/dns-controller-builder/onbuild.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash -ex
-
-# Copyright 2019 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-mkdir -p /go
-export GOPATH=/go
-
-mkdir -p /go/src/k8s.io
-ln -s /src/ /go/src/k8s.io/kops
-
-cd /go/src/k8s.io/kops/
-make dns-controller-gocode
-
-mkdir -p /src/.build/artifacts/
-cp /go/bin/dns-controller /src/.build/artifacts/
-
-chown -R $HOST_UID:$HOST_GID /src/.build/artifacts
diff --git a/images/dns-controller/Dockerfile b/images/dns-controller/Dockerfile
deleted file mode 100644
index 1156b42a80..0000000000
--- a/images/dns-controller/Dockerfile
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2019 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-FROM k8s.gcr.io/debian-base-amd64:0.3
-
-# ca-certificates: Needed to talk to EC2 API
-RUN apt-get update && apt-get install --yes ca-certificates \
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
-
-COPY /.build/artifacts/dns-controller /usr/bin/dns-controller
-
-USER 1000
-
-CMD /usr/bin/dns-controller
diff --git a/images/protokube-builder/Dockerfile b/images/protokube-builder/Dockerfile
deleted file mode 100644
index eedd25cf93..0000000000
--- a/images/protokube-builder/Dockerfile
+++ /dev/null
@@ -1,30 +0,0 @@
-# Copyright 2019 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-FROM k8s.gcr.io/debian-base-amd64:0.3
-
-# Install packages:
-#  curl (to download golang)
-#  git (for getting the current head)
-#  gcc make (for compilation)
-RUN apt-get update && apt-get install --yes --reinstall lsb-base \
-  && apt-get install --yes curl git gcc make bash \
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
-
-# Install golang
-RUN curl -L https://storage.googleapis.com/golang/go1.14.5.linux-amd64.tar.gz | tar zx -C /usr/local
-ENV PATH $PATH:/usr/local/go/bin
-
-COPY onbuild.sh /onbuild.sh
diff --git a/images/protokube-builder/onbuild.sh b/images/protokube-builder/onbuild.sh
deleted file mode 100755
index 4bfedaacc8..0000000000
--- a/images/protokube-builder/onbuild.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/bin/bash -ex
-
-# Copyright 2019 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-mkdir -p /go
-export GOPATH=/go
-
-mkdir -p /go/src/k8s.io
-ln -s /src/ /go/src/k8s.io/kops
-
-ls -lR  /go/src/k8s.io/kops/protokube/cmd/
-
-cd /go/src/k8s.io/kops/
-make protokube
-
-mkdir -p /src/.build/artifacts/
-cp /src/.build/local/protokube /src/.build/artifacts/
-
-# Applying channels calls out to the channels tool
-make channels
-cp /src/.build/local/channels /src/.build/artifacts/
-
-chown -R $HOST_UID:$HOST_GID /src/.build/artifacts
diff --git a/images/protokube/Dockerfile b/images/protokube/Dockerfile
deleted file mode 100644
index 032934ce60..0000000000
--- a/images/protokube/Dockerfile
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright 2019 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-FROM k8s.gcr.io/debian-base-amd64:0.3
-
-# ca-certificates: Needed to talk to EC2 API
-# e2fsprogs: Needed to mount / format ext4 filesytems
-RUN apt-get update && apt-get install --yes \
-  bash ca-certificates e2fsprogs systemd \
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
-
-COPY /.build/artifacts/protokube /usr/bin/protokube
-COPY /.build/artifacts/channels /usr/bin/channels
-
-CMD /usr/bin/protokube
diff --git a/protokube/cmd/protokube/BUILD.bazel b/protokube/cmd/protokube/BUILD.bazel
index 02dce98594..670473ba33 100644
--- a/protokube/cmd/protokube/BUILD.bazel
+++ b/protokube/cmd/protokube/BUILD.bazel
@@ -1,3 +1,5 @@
+package(default_visibility = ["//visibility:public"])
+
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
@@ -30,3 +32,41 @@ go_binary(
     embed = [":go_default_library"],
     visibility = ["//visibility:public"],
 )
+
+load(
+    "@io_bazel_rules_docker//container:container.bzl",
+    "container_image",
+    "container_bundle",
+)
+
+container_image(
+    name = "image",
+    base = "@distroless_base//image",
+    cmd = ["/protokube"],
+    files = [
+        "//channels/cmd/channels",
+        "//protokube/cmd/protokube",
+    ],
+    stamp = True,
+)
+
+container_bundle(
+    name = "image-bundle",
+    images = {
+        "protokube:{STABLE_PROTOKUBE_TAG}": "image",
+    },
+)
+
+load("//tools:gzip.bzl", "gzip")
+
+gzip(
+    name = "image-bundle.tar.gz",
+    src = "image-bundle.tar",
+)
+
+load("//tools:hashes.bzl", "hashes")
+
+hashes(
+    name = "image-bundle.tar.gz.hashes",
+    src = "image-bundle.tar.gz",
+)