diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 69435eb..1684f4a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -5,17 +5,11 @@ stages:
 
 .base:
   variables:
-    ARCHES: "x86_64"
-    TYPES: "qcow2"
-    FEDORA_VERSION: "43"
-    EL9_VERSION: "9.7"
-    EL10_VERSION: "10.1"
-    FROM_REFS: |-
-      quay.io/fedora/fedora-bootc:${FEDORA_VERSION}
-      quay.io/centos-bootc/centos-bootc:stream10
-      quay.io/centos-bootc/centos-bootc:stream9
-      registry.redhat.io/rhel9/rhel-bootc:${EL9_VERSION}
-      registry.redhat.io/rhel10/rhel-bootc:${EL10_VERSION}
+    DISTROS: |-
+      centos-9
+      centos-10
+      rhel-9.7
+      rhel-10.1
 
 .terraform:
   extends: .base
@@ -30,49 +24,21 @@ init:
     - shell
   script:
     - |
-      for FROM_REF in $FROM_REFS; do
-        schutzbot/update_github_status.sh start "$FROM_REF"
+      for DISTRO in $DISTROS; do
+        schutzbot/update_github_status.sh start "$DISTRO"
       done
 
 run:
   extends: .terraform
   stage: run
+  variables:
+    RUNNER: aws/rhel-10.1-ga-x86_64
   parallel:
     matrix:
-      - FROM_REF: "quay.io/fedora/fedora-bootc:${FEDORA_VERSION}"
-        CONTAINERFILE: "fedora"
-        RUNNER: "aws/centos-stream-10-x86_64"
-        FROM_CREDS: ""
-        DST_REF: "quay.io/osbuild/fedora-bootc:${FEDORA_VERSION}"
-        DST_CREDS: "$QUAY_CREDS"
-
-      - FROM_REF: "registry.redhat.io/rhel9/rhel-bootc:${EL9_VERSION}"
-        CONTAINERFILE: "el9"
-        RUNNER: "aws/rhel-10.1-ga-x86_64"
-        FROM_CREDS: "$RH_CREDS"
-        DST_REF: ""
-        DST_CREDS: ""
-
-      - FROM_REF: "quay.io/centos-bootc/centos-bootc:stream10"
-        CONTAINERFILE: "el10"
-        RUNNER: "aws/centos-stream-10-x86_64"
-        FROM_CREDS: ""
-        DST_REF: "quay.io/osbuild/centos-bootc:stream10"
-        DST_CREDS: "$QUAY_CREDS"
-
-      - FROM_REF: "quay.io/centos-bootc/centos-bootc:stream9"
-        CONTAINERFILE: "el9"
-        RUNNER: "aws/centos-stream-10-x86_64"
-        FROM_CREDS: ""
-        DST_REF: "quay.io/osbuild/centos-bootc:stream9"
-        DST_CREDS: "$QUAY_CREDS"
-
-      - FROM_REF: "registry.redhat.io/rhel10/rhel-bootc:${EL10_VERSION}"
-        CONTAINERFILE: "el10"
-        RUNNER: "aws/rhel-10.1-ga-x86_64"
-        FROM_CREDS: "$RH_CREDS"
-        DST_REF: ""
-        DST_CREDS: ""
+      - DISTRO: "centos-9"
+      - DISTRO: "centos-10"
+      - DISTRO: "rhel-9.7"
+      - DISTRO: "rhel-10.1"
 
   before_script:
     - . schutzbot/gitlab-utils.sh
@@ -88,16 +54,16 @@ run:
       fi
     - section_end before_script
   script:
-    - schutzbot/build.sh
+    - schutzbot/container-build.sh $DISTRO
   after_script:
     - . schutzbot/gitlab-utils.sh
     - section_start after_script "Run after script section"
     - schutzbot/ci_details.sh > /tmp/artifacts/ci-details-after-run.txt || true
     - schutzbot/unregister.sh || true
-    - schutzbot/update_github_status.sh update "$FROM_REF" || true
+    - schutzbot/update_github_status.sh update "$DISTRO" || true
     - schutzbot/save_journal.sh || true
     - schutzbot/upload_artifacts.sh
-    - if [ "$CI_JOB_STATUS" = "success" ]; then schutzbot/update_github_status.sh finish "$FROM_REF"; fi
+    - if [ "$CI_JOB_STATUS" = "success" ]; then schutzbot/update_github_status.sh finish "$DISTRO"; fi
     - section_end after_script
 
 finish:
diff --git a/Containerfile.comment b/containerfiles/Containerfile.comment
similarity index 100%
rename from Containerfile.comment
rename to containerfiles/Containerfile.comment
diff --git a/Containerfile.el10-qcow2 b/containerfiles/Containerfile.el10-qcow2
similarity index 100%
rename from Containerfile.el10-qcow2
rename to containerfiles/Containerfile.el10-qcow2
diff --git a/Containerfile.el9-qcow2 b/containerfiles/Containerfile.el9-qcow2
similarity index 100%
rename from Containerfile.el9-qcow2
rename to containerfiles/Containerfile.el9-qcow2
diff --git a/Containerfile.fedora-qcow2 b/containerfiles/Containerfile.fedora-qcow2
similarity index 100%
rename from Containerfile.fedora-qcow2
rename to containerfiles/Containerfile.fedora-qcow2
diff --git a/distribution/Dockerfile-ubi b/distribution/Dockerfile-ubi
new file mode 100644
index 0000000..f582aba
--- /dev/null
+++ b/distribution/Dockerfile-ubi
@@ -0,0 +1,12 @@
+FROM registry.access.redhat.com/ubi10/ubi-minimal:latest
+
+RUN microdnf install -y buildah python3
+
+RUN mkdir /containerfiles
+COPY ./containerfiles/Containerfile* /containerfiles/
+
+# rely on CI scripts for now
+COPY ./schutzbot /schutzbot
+
+COPY ./distribution/entrypoint.py /opt/entrypoint.py
+ENTRYPOINT ["/opt/entrypoint.py"]
diff --git a/distribution/entrypoint.py b/distribution/entrypoint.py
new file mode 100755
index 0000000..1a99170
--- /dev/null
+++ b/distribution/entrypoint.py
@@ -0,0 +1,86 @@
+#!/usr/bin/python3
+
+import argparse
+import os
+import subprocess
+import sys
+
+# hardcoded build matrix for now
+BUILD_MATRIX = {
+    "centos-9": {
+        "from": "quay.io/centos-bootc/centos-bootc:stream9",
+        "dst": "centos-bootc:stream9",
+        "containerfile": "el9",
+    },
+    "centos-10": {
+        "from": "quay.io/centos-bootc/centos-bootc:stream10",
+        "dst": "centos-bootc:stream10",
+        "containerfile": "el10",
+    },
+    "rhel-9.7": {
+        "from": "registry.redhat.io/rhel9/rhel-bootc:9.7",
+        "from_creds": os.getenv("RH_CREDS"),
+        "dst": "rhel-bootc:9.7",
+        "containerfile": "el9",
+    },
+    "rhel-10.1": {
+        "from": "registry.redhat.io/rhel10/rhel-bootc:10.1",
+        "from_creds": os.getenv("RH_CREDS"),
+        "dst": "rhel-bootc:10.1",
+        "containerfile": "el10",
+    },
+}
+
+
+def run_one(build, repo):
+    env = os.environ.copy()
+    env["FROM_REF"] = build["from"]
+    env["DST_REF"] = f"{repo}/{build['dst']}"
+    env["CONTAINERFILE"] = build["containerfile"]
+    if build.get("from_creds"):
+        env["FROM_CREDS"] = build["from_creds"]
+
+    print(f"""
+Running /schutzbot/build.sh with:
+    FROM_REF: {env['FROM_REF']}
+    DST_REF: {env['DST_REF']}
+    CONTAINERFILE: {env['CONTAINERFILE']}
+    FROM_CREDS present: {'yes' if 'FROM_CREDS' in env else 'no'}""")
+
+    subprocess.run([
+        "/schutzbot/build.sh",
+    ], env=env, shell=True, stderr=subprocess.STDOUT, check=True)
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        prog="bootc-foundry container entrypoint",
+        description="Build bootc containers inside container",
+    )
+    parser.add_argument(
+        "--repo",
+        dest="repo",
+        type=str,
+        required=True,
+        help="repository to push derived containers to",
+    )
+    parser.add_argument(
+        "--distro",
+        help="only build specified distros",
+        required=False,
+        type=str,
+        default=[],
+        action="append",
+    )
+    args = parser.parse_args(sys.argv[1:])
+
+    for distro, build in BUILD_MATRIX.items():
+        if args.distro and distro not in args.distro:
+            continue
+        run_one(build, args.repo)
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/schutzbot/build.sh b/schutzbot/build.sh
index 597b398..eee616b 100755
--- a/schutzbot/build.sh
+++ b/schutzbot/build.sh
@@ -69,11 +69,11 @@ DST_REF=${DST_REF:-local}
 for ARCH in $ARCHES; do
     for TYPE in $TYPES; do
         section_start prepare_containerfile "Preparing Containerfile with FROM ${FROM_REF}"
-        cp "Containerfile.comment" "Containerfile"
+        cp -fv "containerfiles/Containerfile.comment" "Containerfile"
         {
             echo "FROM ${FROM_REF}"
             echo "ARG BUILD_DATE=$(date +%Y-%m-%d)"
-            tail -n +2 "Containerfile.${CONTAINERFILE}-${TYPE}"
+            tail -n +2 "containerfiles/Containerfile.${CONTAINERFILE}-${TYPE}"
         } >>"Containerfile"
         cat "Containerfile"
         section_end prepare_containerfile
@@ -82,6 +82,9 @@ for ARCH in $ARCHES; do
         buildah build --layers --arch="$ARCH" \
             --build-arg CONTAINERFILE="Containerfile" \
             --from "${FROM_REF}" \
+            --storage-driver=vfs \
+            --userns=host \
+            --isolation=chroot \
             -f "Containerfile" \
             -t "$DST_REF-$ARCH-$TYPE" .
         section_end "build_${ARCH}_${TYPE}"
@@ -102,19 +105,19 @@ for TYPE in $TYPES; do
 done
 
 section_start create_manifest "Creating manifest for $DST_REF"
-buildah manifest create "$DST_REF"
+buildah manifest create --storage-driver=vfs "$DST_REF"
 section_end create_manifest
 
 for TYPE in $TYPES; do
     section_start "add_to_manifest_${TYPE}" "Adding $TYPE to $DST_REF manifest"
     for ARCH in $ARCHES; do
-        buildah manifest add "$DST_REF" "$DST_REF-$ARCH-$TYPE"
+        buildah manifest add --storage-driver=vfs "$DST_REF" "$DST_REF-$ARCH-$TYPE"
     done
     section_end "add_to_manifest_${TYPE}"
 
     if [ -n "${DST_CREDS:-}" ] && [ -z "${NOPUSH:-}" ]; then
         section_start "push_manifest_${TYPE}" "Pushing manifest $DST_REF to registry"
-        buildah manifest push --all "$DST_REF" "docker://$DST_REF"
+        buildah manifest push --storage-driver=vfs --all "$DST_REF" "docker://$DST_REF"
         section_end "push_manifest_${TYPE}"
     else
         echo "Push skipped: DST_CREDS missing or NOPUSH set"
diff --git a/schutzbot/container-build.sh b/schutzbot/container-build.sh
new file mode 100755
index 0000000..b572c97
--- /dev/null
+++ b/schutzbot/container-build.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+set -euo pipefail
+CONTAINER=$(podman build -f distribution/Dockerfile-ubi . | tail -n 1)
+podman run -e PYTHONUNBUFFERED=1 -e RH_CREDS="${RH_CREDS:-}" "$CONTAINER" --repo placeholder.org --distro "$1"