diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index d4ab8f80..2ee09ede 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -60,6 +60,9 @@ jobs:
         GIT_HASH: ${{ github.event.pull_request.head.sha }}
       run: ./build_system.sh
 
+    - name: Build userdata
+      run: ./scripts/build_userdata.sh
+
     - name: Statistics
       id: stats
       run: |
diff --git a/scripts/build_userdata.sh b/scripts/build_userdata.sh
index e1d06dca..0c6dc67d 100755
--- a/scripts/build_userdata.sh
+++ b/scripts/build_userdata.sh
@@ -6,36 +6,49 @@ ROOT=$DIR/..
 OUTPUT_DIR=$DIR/../output
 GIT_BRANCH=release3-staging
 
+WORKDIR=$(mktemp -d)
+MNTDIR=$WORKDIR/mnt
+USERDATA_IMAGE=$WORKDIR/raw.img
+
 export DOCKER_BUILDKIT=1
-docker build -f $ROOT/Dockerfile.builder -t agnos-meta-builder $DIR \
+docker buildx build --load -f $ROOT/Dockerfile.builder -t agnos-meta-builder $DIR \
   --build-arg UNAME=$(id -nu) \
   --build-arg UID=$(id -u) \
   --build-arg GID=$(id -g)
+MOUNT_CONTAINER_ID=$(docker run -d --privileged -v $WORKDIR:$WORKDIR -v $ROOT:$ROOT agnos-meta-builder)
+
+trap "echo \"Cleaning up containers:\"; \
+docker container rm -f $MOUNT_CONTAINER_ID" EXIT
+
+exec_as_user() {
+  docker exec -u $(id -nu) $MOUNT_CONTAINER_ID "$@"
+}
+
+exec_as_root() {
+  docker exec $MOUNT_CONTAINER_ID "$@"
+}
 
 function create_image() {
   IMAGE_SIZE=$1
 
-  WORKDIR=$(mktemp -d)
-  MNTDIR=$WORKDIR/mnt
-  USERDATA_IMAGE=$WORKDIR/raw.img
-
-  sudo umount $MNTDIR 2> /dev/null || true
-  rm -rf $WORKDIR
-  mkdir $WORKDIR
-  cd $WORKDIR
+  exec_as_root umount $MNTDIR 2> /dev/null || true
+  exec_as_root rm -rf $WORKDIR/*
 
-  fallocate -l $IMAGE_SIZE $USERDATA_IMAGE
-  mkfs.ext4 $USERDATA_IMAGE
+  exec_as_root truncate -s $IMAGE_SIZE $USERDATA_IMAGE
+  exec_as_root mkfs.ext4 $USERDATA_IMAGE
 
-  mkdir $MNTDIR
-  sudo mount $USERDATA_IMAGE $MNTDIR
-  sudo git clone --branch=$GIT_BRANCH --depth=1 https://github.com/commaai/openpilot.git $MNTDIR/openpilot.cache
-  echo "clone done for $(sudo cat $MNTDIR/openpilot.cache/common/version.h)"
-  sudo umount $MNTDIR
+  exec_as_root mkdir $MNTDIR
+  exec_as_root mount $USERDATA_IMAGE $MNTDIR
+  sudo git clone --branch=$GIT_BRANCH --depth=1 https://github.com/commaai/openpilot.git $WORKDIR/openpilot.cache
+  echo "clone done for $(sudo cat $WORKDIR/openpilot.cache/common/version.h)"
+  exec_as_root mv $WORKDIR/openpilot.cache $MNTDIR/
+  exec_as_root chown -R $(id -nu):$(id -nu) $MNTDIR
+  exec_as_root umount $MNTDIR
 
   echo "Sparsify"
-  docker run --rm -u $(id -nu) --entrypoint img2simg -v $WORKDIR:$WORKDIR -v $ROOT:$ROOT -w $DIR agnos-meta-builder $USERDATA_IMAGE $OUTPUT_DIR/userdata_${sz}.img
-  rm -rf $WORKDIR
+  mkdir $OUTPUT_DIR 2> /dev/null || true
+  exec_as_user img2simg $USERDATA_IMAGE $OUTPUT_DIR/userdata_${sz}.img
+  exec_as_root rm -rf $WORKDIR/*
 }
 
 for sz in 30 89 90; do