diff --git a/Makefile b/Makefile
index 5d3c98d..d03ca9f 100644
--- a/Makefile
+++ b/Makefile
@@ -60,6 +60,9 @@ else
 	container = $(APPLIANCE)-build
 endif
 
+PATH := $(CURDIR)/scripts:$(PATH)
+
+export PATH CHROOT container PORTAGE_DIR VA_PKGDIR DISTDIR VA_ARCH
 
 inroot := systemd-nspawn --quiet \
 	--directory=$(CHROOT) \
@@ -78,9 +81,9 @@ COPY_ARGS = --exclude-from=configs/rsync-excludes
 
 ifeq ($(CHANGE_PASSWORD),YES)
 	ifdef ROOT_PASSWORD
-		change_password = $(inroot) usermod -p '$(ROOT_PASSWORD)' root
+		change_password = RUN usermod --password '$(ROOT_PASSWORD)' root
 	else
-		change_password = $(inroot) passwd --delete --expire root
+		change_password = RUN passwd --delete root
 	endif
 endif
 
@@ -117,7 +120,7 @@ else
 	sed -i '/swap/d' $(CHROOT)/etc/fstab
 endif
 	rm -f $(CHROOT)/etc/resolv.conf
-	cp -L /etc/resolv.conf $(CHROOT)/etc/resolv.conf
+	COPY -L /etc/resolv.conf /etc/resolv.conf
 	touch $(PREPROOT)
 
 stage3-$(VA_ARCH).tar.bz2:
@@ -141,28 +144,28 @@ endif
 	touch $(STAGE3)
 
 $(COMPILE_OPTIONS): $(STAGE3) $(PORTAGE_DIR) configs/make.conf.$(VA_ARCH) configs/locale.gen $(PACKAGE_FILES)
-	cp configs/make.conf.$(VA_ARCH) $(CHROOT)/etc/portage/make.conf
+	COPY configs/make.conf.$(VA_ARCH) /etc/portage/make.conf
 	echo ACCEPT_KEYWORDS=$(ACCEPT_KEYWORDS) >> $(CHROOT)/etc/portage/make.conf
 	-[ -f "appliances/$(APPLIANCE)/make.conf" ] && cat "appliances/$(APPLIANCE)/make.conf" >> $(CHROOT)/etc/portage/make.conf
-	cp configs/locale.gen $(CHROOT)/etc/locale.gen
-	$(inroot) locale-gen
+	COPY configs/locale.gen /etc/locale.gen
+	RUN locale-gen
 	for f in $(PACKAGE_FILES); do \
 		base=`basename $$f` ; \
 		mkdir -p $(CHROOT)/etc/portage/$$base; \
-		cp $$f $(CHROOT)/etc/portage/$$base/virtual-appliance-$$base; \
+		COPY $$f /etc/portage/$$base/virtual-appliance-$$base; \
 	done
 	touch $(COMPILE_OPTIONS)
 
 $(KERNEL): $(COMPILE_OPTIONS) $(KERNEL_CONFIG) scripts/build-kernel
 ifneq ($(EXTERNAL_KERNEL),YES)
 	@scripts/echo Configuring kernel
-	cp $(KERNEL_CONFIG) $(CHROOT)/root/kernel.config
-	cp scripts/build-kernel $(CHROOT)/root/build-kernel
-	$(inroot) --setenv=KERNEL=$(KERNEL_PKG) \
-		      --setenv=EMERGE="$(EMERGE)" \
-	          --setenv=USEPKG="$(USEPKG)" \
-			  --setenv=MAKEOPTS="$(MAKEOPTS)" \
-	          /root/build-kernel
+	COPY $(KERNEL_CONFIG) /root/kernel.config
+	COPY scripts/build-kernel /root/build-kernel
+	RUN --setenv=KERNEL=$(KERNEL_PKG) \
+	    --setenv=EMERGE="$(EMERGE)" \
+	    --setenv=USEPKG="$(USEPKG)" \
+	    --setenv=MAKEOPTS="$(MAKEOPTS)" \
+	    /root/build-kernel
 	rm -f $(CHROOT)/root/build-kernel
 endif
 	touch $(KERNEL)
@@ -175,14 +178,14 @@ $(SYSTOOLS): $(PREPROOT) $(COMPILE_OPTIONS)
 		--timezone=$(TIMEZONE) \
 		--hostname=$(HOSTNAME) \
 		--root-password=
-	$(inroot) eselect locale set $(LOCALE)
+	RUN eselect locale set $(LOCALE)
 ifeq ($(DASH),YES)
 	if ! test -e "$(STAGE4_TARBALL)";  \
-	then $(inroot) $(EMERGE) --noreplace $(USEPKG) app-shells/dash; \
+	then RUN $(EMERGE) --noreplace $(USEPKG) app-shells/dash; \
 	echo /bin/dash >> $(CHROOT)/etc/shells; \
-	$(inroot) chsh -s /bin/sh root; \
+	RUN chsh -s /bin/sh root; \
 	fi
-	$(inroot) ln -sf dash /bin/sh
+	RUN ln -sf dash /bin/sh
 endif
 	touch $(SYSTOOLS)
 
@@ -199,35 +202,32 @@ ifeq ($(HEADLESS),YES)
 	sed -i -f scripts/grub-headless.sed $(CHROOT)/boot/grub/grub.cfg
 endif
 endif
-	$(inroot) ln -nsf /run/systemd/resolve/resolv.conf /etc/resolv.conf
+	ln -nsf /run/systemd/resolve/resolv.conf $(CHROOT)/etc/resolv.conf
 	touch $(GRUB)
 
 
-$(SOFTWARE): $(STAGE3) $(SYSTOOLS) configs/eth.network configs/issue $(WORLD)
+$(SOFTWARE): $(STAGE3) $(SYSTOOLS) configs/eth.network configs/issue $(WORLD) $(PROFILE)
 	@scripts/echo Building $(APPLIANCE)-specific software
 	$(MAKE) -C appliances/$(APPLIANCE) preinstall
 	
-	cp $(WORLD) $(CHROOT)/var/tmp/world
-	$(inroot) xargs -a/var/tmp/world -d'\n' -r $(EMERGE) $(USEPKG) --update --newuse --deep 
-	-$(gcc_config)
+	COPY $(WORLD) /var/lib/portage/world
+	RUN $(EMERGE) $(USEPKG) --update --newuse --deep @system
 	
 	@scripts/echo Running @preserved-rebuild
-	$(inroot) $(EMERGE) --usepkg=n @preserved-rebuild
+	RUN $(EMERGE) --usepkg=n @preserved-rebuild
 	
-	cp configs/issue $(CHROOT)/etc/issue
-	-$(gcc_config)
-	$(inroot) $(EMERGE) $(USEPKG) --update --newuse --deep world
-	$(inroot) $(EMERGE) --depclean --with-bdeps=n
-	-$(gcc_config)
-	$(inroot) --setenv EDITOR=/usr/bin/nano etc-update
-	cp configs/eth.network $(CHROOT)/etc/systemd/network/eth.network
-	$(inroot) systemctl enable systemd-networkd.service
-	$(inroot) systemctl enable systemd-resolved.service
+	COPY configs/issue /etc/issue
+	RUN $(EMERGE) $(USEPKG) --update --newuse --deep @world $(grub_package)
+	RUN $(EMERGE) --depclean --with-bdeps=n
+	RUN --setenv EDITOR=/usr/bin/nano etc-update
+	COPY configs/eth.network /etc/systemd/network/eth.network
+	RUN systemctl enable systemd-networkd.service
+	RUN systemctl enable systemd-resolved.service
 ifeq ($(ENABLE_SSHD),YES)
-	$(inroot) systemctl enable sshd.service
+	RUN systemctl enable sshd.service
 endif
 ifeq ($(DASH),YES)
-	$(inroot) $(EMERGE) --depclean app-shells/bash
+	RUN $(EMERGE) --depclean app-shells/bash
 endif
 	$(MAKE) -C appliances/$(APPLIANCE) postinstall
 ifneq ($(PKGLIST),0)
@@ -257,6 +257,10 @@ ifneq ($(EXTERNAL_KERNEL),YES)
 	echo '(hd0) ' `cat partitions` > device-map
 	$(CHROOT)/usr/sbin/grub-install --no-floppy --grub-mkdevicemap=device-map --directory=$(CHROOT)/usr/lib/grub/i386-pc --boot-directory=$(CHROOT)/boot `cat partitions`
 endif
+	COPY device-map /boot/grub/device.map
+	RUN --bind=/dev grub-mkconfig
+	RUN --bind=/dev grub-mkconfig -o /boot/grub/grub.cfg
+	umount $(CHROOT)/boot
 	umount $(CHROOT)
 	rmdir $(CHROOT)
 	sync
@@ -304,10 +308,10 @@ stage4: $(STAGE4_TARBALL)
 
 
 eclean: $(COMPILE_OPTIONS)
-	$(inroot) $(EMERGE) $(USEPKG) --oneshot --noreplace app-portage/gentoolkit
-	$(inroot) eclean-pkg
-	$(inroot) eclean-dist
-	$(inroot) $(EMERGE) --depclean app-portage/gentoolkit
+	RUN $(EMERGE) $(USEPKG) --oneshot --noreplace app-portage/gentoolkit
+	RUN eclean-pkg
+	RUN eclean-dist
+	RUN $(EMERGE) --depclean app-portage/gentoolkit
 	$(MAKE) clean
 
 
@@ -338,7 +342,7 @@ shell: $(PREPROOT)
 	@scripts/echo 'Entering interactive shell for the $(APPLIANCE) build.'
 	@scripts/echo 'Type "exit" or "^D" to leave'
 	@scripts/echo
-	@$(inroot)
+	@RUN
 	@rm -f $(CHROOT)/root/.bash_history
 
 help:
diff --git a/appliances/airport/Makefile b/appliances/airport/Makefile
index ff222f9..c3ac94f 100644
--- a/appliances/airport/Makefile
+++ b/appliances/airport/Makefile
@@ -7,39 +7,39 @@ preinstall:
 
 
 postinstall: airport.service settings.py issue nginx.conf airport-pre.service airport-gameserver.service airport-wsgi.service
-	$(inroot) eselect postgresql set $(PGVER)
+	RUN eselect postgresql set $(PGVER)
 	rm -rf $(CHROOT)/var/lib/postgresql/$(PGVER)
-	$(inroot) bash -c "echo y |$(EMERGE) --config postgresql:$(PGVER)"
-	$(inroot) systemctl enable postgresql-$(PGVER)
-	$(inroot) $(EMERGE) --oneshot --noreplace $(USEPKG) dev-python/setuptools dev-python/virtualenv
+	RUN bash -c "echo y |$(EMERGE) --config postgresql:$(PGVER)"
+	RUN systemctl enable postgresql-$(PGVER)
+	RUN $(EMERGE) --oneshot --noreplace $(USEPKG) dev-python/setuptools dev-python/virtualenv
 	rm -rf $(CHROOT)/$(APP_ROOT)
 	hg clone -u $(AIRPORT_BRANCH) $(AIRPORT_REPO) $(CHROOT)/$(APP_ROOT)
 	chroot $(CHROOT) virtualenv -p /usr/bin/python3 $(APP_ROOT)
-	$(inroot) bash -c ". $(APP_ROOT)/bin/activate ; pip install -r $(APP_ROOT)/requirements.txt"
-	$(inroot) bash -c ". $(APP_ROOT)/bin/activate ; pip install psycopg2 uwsgi"
-	cp settings.py $(CHROOT)/$(APP_ROOT)/djangoproject/djangoproject
-	$(inroot) id -u airport >/dev/null || $(inroot) useradd -d $(APP_ROOT) -M -U -G postgres airport
-	$(inroot) chown -R airport:airport $(APP_ROOT)
+	RUN bash -c ". $(APP_ROOT)/bin/activate ; pip install -r $(APP_ROOT)/requirements.txt"
+	RUN bash -c ". $(APP_ROOT)/bin/activate ; pip install psycopg2 uwsgi"
+	COPY settings.py /$(APP_ROOT)/djangoproject/djangoproject
+	RUN id -u airport >/dev/null || RUN useradd -d $(APP_ROOT) -M -U -G postgres airport
+	RUN chown -R airport:airport $(APP_ROOT)
 ifdef AIRPORT_SERIES
 	cat settings_$(AIRPORT_SERIES).py >> $(CHROOT)/$(APP_ROOT)/djangoproject/djangoproject/settings.py
-	cp $(CHROOT)/$(APP_ROOT)/djangoproject/airport/fixtures/$(AIRPORT_SERIES).json \
-		$(CHROOT)/$(APP_ROOT)/djangoproject/airport/fixtures/initial_data.json
+	RUN cp /$(APP_ROOT)/djangoproject/airport/fixtures/$(AIRPORT_SERIES).json \
+		/$(APP_ROOT)/djangoproject/airport/fixtures/initial_data.json
 endif
-	cp issue $(CHROOT)/etc/issue
-	cp -u airport-pre.service $(CHROOT)/etc/systemd/system/airport-pre.service
-	cp -u airport-wsgi.service $(CHROOT)/etc/systemd/system/airport-wsgi.service
-	cp -u airport-gameserver.service $(CHROOT)/etc/systemd/system/airport-gameserver.service
+	COPY issue /etc/issue
+	COPY -u airport-pre.service /etc/systemd/system/airport-pre.service
+	COPY -u airport-wsgi.service /etc/systemd/system/airport-wsgi.service
+	COPY -u airport-gameserver.service /etc/systemd/system/airport-gameserver.service
 	$(M4) -D HOSTNAME=$(HOSTNAME) nginx.conf > $(CHROOT)/etc/nginx/nginx.conf
-	$(inroot) gpasswd -a nginx airport
-	$(inroot) systemctl enable airport-wsgi.service
-	$(inroot) systemctl enable airport-gameserver.service
+	RUN gpasswd -a nginx airport
+	RUN systemctl enable airport-wsgi.service
+	RUN systemctl enable airport-gameserver.service
 ifeq ($(AVAHI),YES)
-	$(inroot) $(EMERGE) --noreplace $(USEPKG) net-dns/avahi
-	$(inroot) rm -f /etc/avahi/services/*
-	cp airport.service $(CHROOT)/etc/avahi/services
-	$(inroot) systemctl enable avahi-daemon
+	RUN $(EMERGE) --noreplace $(USEPKG) net-dns/avahi
+	RUN rm -f /etc/avahi/services/*
+	COPY airport.service /etc/avahi/services
+	RUN systemctl enable avahi-daemon
 endif
-	$(inroot) $(EMERGE) --depclean --with-bdeps=n
+	RUN $(EMERGE) --depclean --with-bdeps=n
 
 
 clean:
diff --git a/appliances/docker/Makefile b/appliances/docker/Makefile
index f03c9d1..ba30fd2 100644
--- a/appliances/docker/Makefile
+++ b/appliances/docker/Makefile
@@ -1,9 +1,9 @@
 preinstall:
 
 postinstall: 30-ipforward.conf eth.network
-	cp 30-ipforward.conf $(CHROOT)/etc/sysctl.d/
-	cp eth.network $(CHROOT)/etc/systemd/network/
-	$(inroot) systemctl enable docker.service
+	COPY 30-ipforward.conf /etc/sysctl.d/
+	COPY eth.network /etc/systemd/network/
+	RUN systemctl enable docker.service
 
 clean:
 
diff --git a/appliances/elasticsearch/Makefile b/appliances/elasticsearch/Makefile
index f5a13ac..4b5f894 100644
--- a/appliances/elasticsearch/Makefile
+++ b/appliances/elasticsearch/Makefile
@@ -6,33 +6,33 @@ ES_URL = https://artifacts.elastic.co/downloads/elasticsearch/$(ES_TARBALL)
 preinstall:
 
 create_user:
-	-$(inroot) useradd --system \
+	-RUN useradd --system \
 		--comment "Elastic Search" \
 		--home-dir=$(ES_HOME) \
 		--create-home \
 		elastic
 
 install_elasticsearch:
-	$(inroot) test -f /usr/portage/distfiles/$(ES_TARBALL) || \
-		$(inroot) wget -P /usr/portage/distfiles $(ES_URL)
-	$(inroot) tar xf /usr/portage/distfiles/$(ES_TARBALL) -C $(ES_HOME)
-	$(inroot) sh -c 'cd $(ES_HOME) && ln -s elasticsearch-$(ES_VER)/* .'
+	RUN test -f /usr/portage/distfiles/$(ES_TARBALL) || \
+		RUN wget -P /usr/portage/distfiles $(ES_URL)
+	RUN tar xf /usr/portage/distfiles/$(ES_TARBALL) -C $(ES_HOME)
+	RUN sh -c 'cd $(ES_HOME) && ln -s elasticsearch-$(ES_VER)/* .'
 
 install_license:
-	$(inroot) sh -c 'cd $(ES_HOME) && ./bin/plugin install license'
+	RUN sh -c 'cd $(ES_HOME) && ./bin/plugin install license'
 
 install_marvel: install_license
-	$(inroot) sh -c 'cd $(ES_HOME) && ./bin/plugin install marvel-agent'
+	RUN sh -c 'cd $(ES_HOME) && ./bin/plugin install marvel-agent'
 	echo 'marvel.agent.enabled: false' >> $(CHROOT)/$(ES_HOME)/config/elasticsearch.yml
 
 postinstall: elasticsearch.service
 	$(MAKE) create_user
-	$(inroot) rm -rf $(ES_HOME)
-	$(inroot) mkdir -p $(ES_HOME)
+	RUN rm -rf $(ES_HOME)
+	RUN mkdir -p $(ES_HOME)
 	$(MAKE) install_elasticsearch
-	$(inroot) chown -R elastic:elastic $(ES_HOME)
-	cp elasticsearch.service $(CHROOT)/etc/systemd/system
-	$(inroot) systemctl enable elasticsearch.service
+	RUN chown -R elastic:elastic $(ES_HOME)
+	COPY elasticsearch.service /etc/systemd/system
+	RUN systemctl enable elasticsearch.service
 
 clean:
 
diff --git a/appliances/jenkins/Makefile b/appliances/jenkins/Makefile
index db35c02..e06ae4d 100644
--- a/appliances/jenkins/Makefile
+++ b/appliances/jenkins/Makefile
@@ -4,7 +4,7 @@ JENKINS_URL = http://mirrors.jenkins-ci.org/war/latest/jenkins.war
 preinstall:
 
 create_user:
-	-$(inroot) useradd --system \
+	-RUN useradd --system \
 		--comment "Jenkins CI" \
 		--home-dir=$(JENKINS_HOME) \
 		--create-home \
@@ -12,7 +12,7 @@ create_user:
 
 
 $(CHROOT)/$(JENKINS_HOME)/jenkins.war:
-	$(inroot) wget -O $(JENKINS_HOME)/jenkins.war $(JENKINS_URL)
+	RUN wget -O $(JENKINS_HOME)/jenkins.war $(JENKINS_URL)
 
 
 install_jenkins:
@@ -21,14 +21,14 @@ install_jenkins:
 
 postinstall: jenkins.service nginx.conf
 	$(MAKE) create_user
-	$(inroot) rm -rf $(JENKINS_HOME)
-	$(inroot) mkdir -p $(JENKINS_HOME)
+	RUN rm -rf $(JENKINS_HOME)
+	RUN mkdir -p $(JENKINS_HOME)
 	$(MAKE) install_jenkins
-	$(inroot) chown -R jenkins:jenkins $(JENKINS_HOME)
-	cp jenkins.service $(CHROOT)/etc/systemd/system
-	$(inroot) systemctl enable jenkins.service
-	cp nginx.conf $(CHROOT)/etc/nginx/nginx.conf
-	$(inroot) systemctl enable nginx.service
+	RUN chown -R jenkins:jenkins $(JENKINS_HOME)
+	COPY jenkins.service /etc/systemd/system
+	RUN systemctl enable jenkins.service
+	COPY nginx.conf /etc/nginx/nginx.conf
+	RUN systemctl enable nginx.service
 
 clean:
 
diff --git a/appliances/mariadb/Makefile b/appliances/mariadb/Makefile
index 5f0f5bd..4aa2be2 100644
--- a/appliances/mariadb/Makefile
+++ b/appliances/mariadb/Makefile
@@ -12,8 +12,8 @@ $(root_conf): my.cnf.root
 
 postinstall: $(system_conf) $(root_conf)
 	rm -rf $(CHROOT)/var/lib/mysql
-	$(inroot) bash -c 'yes gentoo | emerge --config dev-db/mariadb'
-	$(inroot) systemctl enable mariadb
+	RUN bash -c 'yes gentoo | emerge --config dev-db/mariadb'
+	RUN systemctl enable mariadb
 
 clean:
 
diff --git a/appliances/mongodb/Makefile b/appliances/mongodb/Makefile
index 1f46d67..ef30a48 100644
--- a/appliances/mongodb/Makefile
+++ b/appliances/mongodb/Makefile
@@ -3,7 +3,7 @@ preinstall:
 
 postinstall:
 	sed -i 's/127\.0\.0\.1/0.0.0.0/g' "$(CHROOT)"/etc/mongodb.conf
-	$(inroot) systemctl enable mongodb.service
+	RUN systemctl enable mongodb.service
 
 clean:
 
diff --git a/appliances/rabbitmq/Makefile b/appliances/rabbitmq/Makefile
index c7505d3..cc857e0 100644
--- a/appliances/rabbitmq/Makefile
+++ b/appliances/rabbitmq/Makefile
@@ -1,7 +1,7 @@
 preinstall:
 
 postinstall:
-	$(inroot) systemctl enable rabbitmq.service
+	RUN systemctl enable rabbitmq.service
 
 clean:
 
diff --git a/appliances/teamplayer/Makefile b/appliances/teamplayer/Makefile
index 6aeeebd..9d20352 100644
--- a/appliances/teamplayer/Makefile
+++ b/appliances/teamplayer/Makefile
@@ -19,49 +19,52 @@ post_files += issue nginx.conf teamplayer.service
 preinstall:
 
 postinstall: $(post_files) $(SCROBBLER_AUTH) urls.py
-	$(inroot) passwd -d postgres
+	RUN passwd -d postgres
 	rm -rf $(CHROOT)/var/lib/postgresql/$(PGVER)/data
-	$(inroot) eselect postgresql unset
-	$(inroot) eselect postgresql set $(PGVER)
-	$(inroot) bash -c "echo y |$(EMERGE) --config postgresql:$(PGVER)"
+	RUN eselect postgresql unset
+	RUN eselect postgresql set $(PGVER)
+	RUN bash -c "echo y |$(EMERGE) --config postgresql:$(PGVER)"
 ifeq ($(AVAHI),YES)
-	$(inroot) $(EMERGE) --noreplace $(USEPKG) net-dns/avahi
-	$(inroot) rm -f /etc/avahi/services/*
-	cp teamplayer.service $(CHROOT)/etc/avahi/services
-	$(inroot) systemctl enable avahi-daemon.service
+	RUN $(EMERGE) --noreplace $(USEPKG) net-dns/avahi
+	RUN rm -f /etc/avahi/services/*
+	COPY teamplayer.service /etc/avahi/services
+	RUN systemctl enable avahi-daemon.service
 endif
-	$(inroot) $(EMERGE) --oneshot --noreplace $(USEPKG) dev-python/setuptools dev-python/virtualenv dev-vcs/mercurial
-	$(inroot) getent passwd $(TP_USER) || \
-		$(inroot) useradd -c "Teamplayer Server" -G postgres -U -d $(TP_HOME) $(TP_USER)
+	RUN $(EMERGE) --oneshot --noreplace $(USEPKG) dev-python/setuptools dev-python/virtualenv dev-vcs/mercurial
+	RUN getent passwd $(TP_USER) || \
+		RUN useradd -c "Teamplayer Server" -G postgres -U -d $(TP_HOME) $(TP_USER)
 	rm -rf $(CHROOT)/$(TP_HOME)
 	mkdir -p $(CHROOT)/$(TP_HOME)
-	cp bash_profile $(CHROOT)$(TP_HOME)/.bash_profile
-	$(inroot) virtualenv $(TP_HOME)
-	$(inroot) bash -c ". $(TP_HOME)/bin/activate ; LANG=en_US.utf8 pip install --no-cache-dir hg+$(TP_REPO)@$(TP_BRANCH)"
-	$(inroot) bash -c ". $(TP_HOME)/bin/activate ; pip install --no-cache-dir psycopg2 uwsgi Whoosh setproctitle"
-	$(inroot) bash -c ". $(TP_HOME)/bin/activate ; django-admin.py startproject project $(TP_HOME)"
+	COPY bash_profile $(TP_HOME)/.bash_profile
+	RUN virtualenv $(TP_HOME)
+	#RUN bash -c ". $(TP_HOME)/bin/activate ; LANG=en_US.utf8 pip install --no-cache-dir hg+$(TP_REPO)@$(TP_BRANCH)"
+	RUN --setenv=LANG=en_US.utf8 $(PYTHON) -m pip install --no-cache-dir hg+$(TP_REPO)@$(TP_BRANCH)
+	RUN $(PYTHON) -m pip install --no-cache-dir psycopg2 uwsgi Whoosh setproctitle
+	#RUN bash -c ". $(TP_HOME)/bin/activate ; pip install --no-cache-dir psycopg2 uwsgi Whoosh setproctitle"
+	#RUN bash -c ". $(TP_HOME)/bin/activate ; django-admin.py startproject project $(TP_HOME)"
+	RUN $(TP_HOME)/bin/django-admin startproject project $(TP_HOME)
 	chmod +x $(CHROOT)/$(TP_HOME)/manage.py
-	$(inroot) ln -sf ../manage.py $(TP_HOME)/bin/manage
-	cp urls.py $(CHROOT)/$(TP_HOME)/project/urls.py
+	RUN ln -sf ../manage.py $(TP_HOME)/bin/manage
+	COPY urls.py $(TP_HOME)/project/urls.py
 	$(M4C) settings.py >> $(CHROOT)/$(TP_HOME)/project/settings.py
 ifdef SCROBBLER_AUTH
 	cat $(SCROBBLER_AUTH) >> $(CHROOT)/$(TP_HOME)/project/settings.py
 endif
-	$(inroot) bash -c ". $(TP_HOME)/bin/activate; cd $(TP_HOME); DJANGO_SETTINGS_MODULE=project.settings $(TP_HOME)/manage.py collectstatic --noinput"
-	$(inroot) $(INSTALL) -d -o $(TP_USER) -g $(TP_USER) $(TP_DB)
-	$(inroot) $(INSTALL) -d -o $(TP_USER) -g $(TP_USER) $(TP_DB)/songs
-	$(inroot) mkdir -p $(TP_HOME)/library
-	$(inroot) chown -R $(TP_USER):$(TP_USER) $(TP_HOME)
-	$(inroot) $(INSTALL) -d -o $(TP_USER) -g $(TP_USER) $(TP_DB)/mpd
+	RUN bash -c ". $(TP_HOME)/bin/activate; cd $(TP_HOME); DJANGO_SETTINGS_MODULE=project.settings $(TP_HOME)/manage.py collectstatic --noinput"
+	RUN $(INSTALL) -d -o $(TP_USER) -g $(TP_USER) $(TP_DB)
+	RUN $(INSTALL) -d -o $(TP_USER) -g $(TP_USER) $(TP_DB)/songs
+	RUN mkdir -p $(TP_HOME)/library
+	RUN chown -R $(TP_USER):$(TP_USER) $(TP_HOME)
+	RUN $(INSTALL) -d -o $(TP_USER) -g $(TP_USER) $(TP_DB)/mpd
 	$(M4C) teamplayer-pre.service > $(CHROOT)/etc/systemd/system/teamplayer-pre.service
 	$(M4C) teamplayer-wsgi.service > $(CHROOT)/etc/systemd/system/teamplayer-wsgi.service
 	$(M4C) teamplayer-spindoctor.service > $(CHROOT)/etc/systemd/system/teamplayer-spindoctor.service
-	cp issue $(CHROOT)/etc/issue
+	COPY issue /etc/issue
 	$(M4C) nginx.conf > $(CHROOT)/etc/nginx/nginx.conf
-	$(inroot) gpasswd -a nginx teamplayer
-	$(inroot) systemctl enable teamplayer-wsgi.service
-	$(inroot) systemctl enable teamplayer-spindoctor.service
-	$(inroot) $(EMERGE) --depclean --with-bdeps=n
+	RUN gpasswd -a nginx teamplayer
+	RUN systemctl enable teamplayer-wsgi.service
+	RUN systemctl enable teamplayer-spindoctor.service
+	RUN $(EMERGE) --depclean --with-bdeps=n
 
 clean:
 
diff --git a/appliances/vabuilder/Makefile b/appliances/vabuilder/Makefile
index c0a2424..ebd7188 100644
--- a/appliances/vabuilder/Makefile
+++ b/appliances/vabuilder/Makefile
@@ -8,11 +8,11 @@ M4C = $(M4) $(M4_DEFS)
 preinstall:
 
 postinstall: nginx.conf.m4
-	$(inroot) rm -rf $(VABUILDER_HOME)
-	$(inroot) hg clone -u $(VABUILDER_REV) $(VABUILDER_REPO) $(VABUILDER_HOME)
-	$(inroot) ln -nsf $(VABUILDER_HOME) /root/vabuilder
+	RUN rm -rf $(VABUILDER_HOME)
+	RUN hg clone -u $(VABUILDER_REV) $(VABUILDER_REPO) $(VABUILDER_HOME)
+	RUN ln -nsf $(VABUILDER_HOME) /root/vabuilder
 	$(M4C) nginx.conf.m4 > $(CHROOT)/etc/nginx/nginx.conf
-	$(inroot) systemctl enable nginx.service
+	RUN systemctl enable nginx.service
 
 
 clean:
diff --git a/appliances/x/Makefile b/appliances/x/Makefile
index 081355f..b47e0bc 100644
--- a/appliances/x/Makefile
+++ b/appliances/x/Makefile
@@ -3,8 +3,8 @@ xdm_files = $(wildcard xdm/*)
 preinstall:
 
 postinstall: $(xdm_files)
-	cp xdm/* "$(CHROOT)"/etc/X11/xdm
-	$(inroot) systemctl enable xdm
+	COPY xdm/* /etc/X11/xdm
+	RUN systemctl enable xdm
 
 clean:
 
diff --git a/appliances/base/package.keywords b/configs/profile/package.accept_keywords
similarity index 100%
rename from appliances/base/package.keywords
rename to configs/profile/package.accept_keywords
diff --git a/scripts/COPY b/scripts/COPY
new file mode 100755
index 0000000..ee8587f
--- /dev/null
+++ b/scripts/COPY
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+"""Copy files from source to target in the chroot"""
+import os
+import subprocess
+import sys
+
+
+def main():
+    chroot = os.environ["CHROOT"]
+    target = sys.argv[-1]
+    chroot_target = os.path.join(chroot, target.lstrip('/'))
+    command = ["cp"] + sys.argv[1:-1] + [chroot_target]
+
+    subprocess.check_call(command)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/RUN b/scripts/RUN
new file mode 100755
index 0000000..9bf1dd5
--- /dev/null
+++ b/scripts/RUN
@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+import os
+import subprocess
+import sys
+
+
+def main():
+    environ = os.environ
+
+    command = [
+        "systemd-nspawn",
+        "--quiet",
+        f"--directory={environ['CHROOT']}",
+        f"--machine={environ['container']}",
+        f"--bind={environ['PORTAGE_DIR']}:/usr/portage",
+        f"--bind={environ['VA_PKGDIR']}:/usr/portage/packages",
+        f"--bind={environ['DISTDIR']}:/usr/portage/distfiles",
+    ] + sys.argv[1:]
+
+    if os.environ.get("VA_ARCH") == "linux32":
+        command = ["linux32"] + command
+
+    subprocess.check_call(command)
+
+
+if __name__ == "__main__":
+    main()