diff --git a/20.10/Dockerfile b/20.10/cli/Dockerfile
similarity index 89%
rename from 20.10/Dockerfile
rename to 20.10/cli/Dockerfile
index cae822625..67aacbcaa 100644
--- a/20.10/Dockerfile
+++ b/20.10/cli/Dockerfile
@@ -20,9 +20,6 @@ RUN apk add --no-cache \
 RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
 
 ENV DOCKER_VERSION 20.10.17
-# TODO ENV DOCKER_SHA256
-# https://github.com/docker/docker-ce/blob/5b073ee2cf564edee5adca05eee574142f7627bb/components/packaging/static/hash_files !!
-# (no SHA file artifacts on download.docker.com yet as of 2017-06-07 though)
 
 RUN set -eux; \
 	\
@@ -40,23 +37,25 @@ RUN set -eux; \
 		'aarch64') \
 			url='https://download.docker.com/linux/static/stable/aarch64/docker-20.10.17.tgz'; \
 			;; \
-		*) echo >&2 "error: unsupported architecture ($apkArch)"; exit 1 ;; \
+		*) echo >&2 "error: unsupported 'docker.tgz' architecture ($apkArch)"; exit 1 ;; \
 	esac; \
 	\
-	wget -O docker.tgz "$url"; \
+	wget -O 'docker.tgz' "$url"; \
 	\
 	tar --extract \
 		--file docker.tgz \
 		--strip-components 1 \
 		--directory /usr/local/bin/ \
+		--no-same-owner \
+		'docker/docker' \
 	; \
 	rm docker.tgz; \
 	\
-	dockerd --version; \
 	docker --version
 
 ENV DOCKER_BUILDX_VERSION 0.8.2
 RUN set -eux; \
+	\
 	apkArch="$(apk --print-arch)"; \
 	case "$apkArch" in \
 		'x86_64') \
@@ -87,17 +86,22 @@ RUN set -eux; \
 			url='https://github.com/docker/buildx/releases/download/v0.8.2/buildx-v0.8.2.linux-s390x'; \
 			sha256='ec4bb6f271f38dca5a377a70be24ee2108a85f6e6ba511ad3b805c4f1602a0d2'; \
 			;; \
-		*) echo >&2 "warning: unsupported buildx architecture ($apkArch); skipping"; exit 0 ;; \
+		*) echo >&2 "warning: unsupported 'docker-buildx' architecture ($apkArch); skipping"; exit 0 ;; \
 	esac; \
+	\
+	wget -O 'docker-buildx' "$url"; \
+	echo "$sha256 *"'docker-buildx' | sha256sum -c -; \
+	\
 	plugin='/usr/libexec/docker/cli-plugins/docker-buildx'; \
 	mkdir -p "$(dirname "$plugin")"; \
-	wget -O "$plugin" "$url"; \
-	echo "$sha256 *$plugin" | sha256sum -c -; \
+	mv -vT 'docker-buildx' "$plugin"; \
 	chmod +x "$plugin"; \
+	\
 	docker buildx version
 
 ENV DOCKER_COMPOSE_VERSION 2.7.0
 RUN set -eux; \
+	\
 	apkArch="$(apk --print-arch)"; \
 	case "$apkArch" in \
 		'x86_64') \
@@ -124,13 +128,17 @@ RUN set -eux; \
 			url='https://github.com/docker/compose/releases/download/v2.7.0/docker-compose-linux-s390x'; \
 			sha256='429498246e1d4778669e781a70e659ba59fa8bb3cdee45f8ce8e01a716a12aff'; \
 			;; \
-		*) echo >&2 "warning: unsupported compose architecture ($apkArch); skipping"; exit 0 ;; \
+		*) echo >&2 "warning: unsupported 'docker-compose' architecture ($apkArch); skipping"; exit 0 ;; \
 	esac; \
+	\
+	wget -O 'docker-compose' "$url"; \
+	echo "$sha256 *"'docker-compose' | sha256sum -c -; \
+	\
 	plugin='/usr/libexec/docker/cli-plugins/docker-compose'; \
 	mkdir -p "$(dirname "$plugin")"; \
-	wget -O "$plugin" "$url"; \
-	echo "$sha256 *$plugin" | sha256sum -c -; \
+	mv -vT 'docker-compose' "$plugin"; \
 	chmod +x "$plugin"; \
+	\
 	ln -sv "$plugin" /usr/local/bin/; \
 	docker-compose --version; \
 	docker compose version
diff --git a/20.10/docker-entrypoint.sh b/20.10/cli/docker-entrypoint.sh
similarity index 100%
rename from 20.10/docker-entrypoint.sh
rename to 20.10/cli/docker-entrypoint.sh
diff --git a/20.10/modprobe.sh b/20.10/cli/modprobe.sh
similarity index 100%
rename from 20.10/modprobe.sh
rename to 20.10/cli/modprobe.sh
diff --git a/20.10/dind-rootless/Dockerfile b/20.10/dind-rootless/Dockerfile
index d56c683c3..725ef2f75 100644
--- a/20.10/dind-rootless/Dockerfile
+++ b/20.10/dind-rootless/Dockerfile
@@ -29,10 +29,10 @@ RUN set -eux; \
 		'aarch64') \
 			url='https://download.docker.com/linux/static/stable/aarch64/docker-rootless-extras-20.10.17.tgz'; \
 			;; \
-		*) echo >&2 "error: unsupported architecture ($apkArch)"; exit 1 ;; \
+		*) echo >&2 "error: unsupported 'rootless.tgz' architecture ($apkArch)"; exit 1 ;; \
 	esac; \
 	\
-	wget -O rootless.tgz "$url"; \
+	wget -O 'rootless.tgz' "$url"; \
 	\
 	tar --extract \
 		--file rootless.tgz \
diff --git a/20.10/dind/Dockerfile b/20.10/dind/Dockerfile
index b319a2b06..ac2295a9e 100644
--- a/20.10/dind/Dockerfile
+++ b/20.10/dind/Dockerfile
@@ -4,7 +4,7 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM docker:20.10
+FROM docker:20.10-cli
 
 # https://github.com/docker/docker/blob/master/project/PACKAGERS.md#runtime-dependencies
 RUN set -eux; \
@@ -37,6 +37,42 @@ RUN set -eux; \
 	echo 'dockremap:165536:65536' >> /etc/subuid; \
 	echo 'dockremap:165536:65536' >> /etc/subgid
 
+RUN set -eux; \
+	\
+	apkArch="$(apk --print-arch)"; \
+	case "$apkArch" in \
+		'x86_64') \
+			url='https://download.docker.com/linux/static/stable/x86_64/docker-20.10.17.tgz'; \
+			;; \
+		'armhf') \
+			url='https://download.docker.com/linux/static/stable/armel/docker-20.10.17.tgz'; \
+			;; \
+		'armv7') \
+			url='https://download.docker.com/linux/static/stable/armhf/docker-20.10.17.tgz'; \
+			;; \
+		'aarch64') \
+			url='https://download.docker.com/linux/static/stable/aarch64/docker-20.10.17.tgz'; \
+			;; \
+		*) echo >&2 "error: unsupported 'docker.tgz' architecture ($apkArch)"; exit 1 ;; \
+	esac; \
+	\
+	wget -O 'docker.tgz' "$url"; \
+	\
+	tar --extract \
+		--file docker.tgz \
+		--strip-components 1 \
+		--directory /usr/local/bin/ \
+		--no-same-owner \
+# we exclude the CLI binary because we already extracted that over in the "docker:20.10-cli" image that we're FROM and we don't want to duplicate those bytes again in this layer
+		--exclude 'docker/docker' \
+	; \
+	rm docker.tgz; \
+	\
+	dockerd --version; \
+	containerd --version; \
+	ctr --version; \
+	runc --version
+
 # https://github.com/docker/docker/tree/master/hack/dind
 ENV DIND_COMMIT 42b1175eda071c0e9121e1d64345928384a93df1
 
diff --git a/20.10/git/Dockerfile b/20.10/git/Dockerfile
index d23654fd2..8851cd7b0 100644
--- a/20.10/git/Dockerfile
+++ b/20.10/git/Dockerfile
@@ -4,6 +4,6 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM docker:20.10
+FROM docker:20.10-cli
 
 RUN apk add --no-cache git
diff --git a/22.06-rc/Dockerfile b/22.06-rc/cli/Dockerfile
similarity index 89%
rename from 22.06-rc/Dockerfile
rename to 22.06-rc/cli/Dockerfile
index 3be03030a..59fac85e4 100644
--- a/22.06-rc/Dockerfile
+++ b/22.06-rc/cli/Dockerfile
@@ -20,9 +20,6 @@ RUN apk add --no-cache \
 RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
 
 ENV DOCKER_VERSION 22.06.0-beta.0
-# TODO ENV DOCKER_SHA256
-# https://github.com/docker/docker-ce/blob/5b073ee2cf564edee5adca05eee574142f7627bb/components/packaging/static/hash_files !!
-# (no SHA file artifacts on download.docker.com yet as of 2017-06-07 though)
 
 RUN set -eux; \
 	\
@@ -40,23 +37,25 @@ RUN set -eux; \
 		'aarch64') \
 			url='https://download.docker.com/linux/static/test/aarch64/docker-22.06.0-beta.0.tgz'; \
 			;; \
-		*) echo >&2 "error: unsupported architecture ($apkArch)"; exit 1 ;; \
+		*) echo >&2 "error: unsupported 'docker.tgz' architecture ($apkArch)"; exit 1 ;; \
 	esac; \
 	\
-	wget -O docker.tgz "$url"; \
+	wget -O 'docker.tgz' "$url"; \
 	\
 	tar --extract \
 		--file docker.tgz \
 		--strip-components 1 \
 		--directory /usr/local/bin/ \
+		--no-same-owner \
+		'docker/docker' \
 	; \
 	rm docker.tgz; \
 	\
-	dockerd --version; \
 	docker --version
 
 ENV DOCKER_BUILDX_VERSION 0.8.2
 RUN set -eux; \
+	\
 	apkArch="$(apk --print-arch)"; \
 	case "$apkArch" in \
 		'x86_64') \
@@ -87,17 +86,22 @@ RUN set -eux; \
 			url='https://github.com/docker/buildx/releases/download/v0.8.2/buildx-v0.8.2.linux-s390x'; \
 			sha256='ec4bb6f271f38dca5a377a70be24ee2108a85f6e6ba511ad3b805c4f1602a0d2'; \
 			;; \
-		*) echo >&2 "warning: unsupported buildx architecture ($apkArch); skipping"; exit 0 ;; \
+		*) echo >&2 "warning: unsupported 'docker-buildx' architecture ($apkArch); skipping"; exit 0 ;; \
 	esac; \
+	\
+	wget -O 'docker-buildx' "$url"; \
+	echo "$sha256 *"'docker-buildx' | sha256sum -c -; \
+	\
 	plugin='/usr/libexec/docker/cli-plugins/docker-buildx'; \
 	mkdir -p "$(dirname "$plugin")"; \
-	wget -O "$plugin" "$url"; \
-	echo "$sha256 *$plugin" | sha256sum -c -; \
+	mv -vT 'docker-buildx' "$plugin"; \
 	chmod +x "$plugin"; \
+	\
 	docker buildx version
 
 ENV DOCKER_COMPOSE_VERSION 2.7.0
 RUN set -eux; \
+	\
 	apkArch="$(apk --print-arch)"; \
 	case "$apkArch" in \
 		'x86_64') \
@@ -124,13 +128,17 @@ RUN set -eux; \
 			url='https://github.com/docker/compose/releases/download/v2.7.0/docker-compose-linux-s390x'; \
 			sha256='429498246e1d4778669e781a70e659ba59fa8bb3cdee45f8ce8e01a716a12aff'; \
 			;; \
-		*) echo >&2 "warning: unsupported compose architecture ($apkArch); skipping"; exit 0 ;; \
+		*) echo >&2 "warning: unsupported 'docker-compose' architecture ($apkArch); skipping"; exit 0 ;; \
 	esac; \
+	\
+	wget -O 'docker-compose' "$url"; \
+	echo "$sha256 *"'docker-compose' | sha256sum -c -; \
+	\
 	plugin='/usr/libexec/docker/cli-plugins/docker-compose'; \
 	mkdir -p "$(dirname "$plugin")"; \
-	wget -O "$plugin" "$url"; \
-	echo "$sha256 *$plugin" | sha256sum -c -; \
+	mv -vT 'docker-compose' "$plugin"; \
 	chmod +x "$plugin"; \
+	\
 	ln -sv "$plugin" /usr/local/bin/; \
 	docker-compose --version; \
 	docker compose version
diff --git a/22.06-rc/docker-entrypoint.sh b/22.06-rc/cli/docker-entrypoint.sh
similarity index 100%
rename from 22.06-rc/docker-entrypoint.sh
rename to 22.06-rc/cli/docker-entrypoint.sh
diff --git a/22.06-rc/modprobe.sh b/22.06-rc/cli/modprobe.sh
similarity index 100%
rename from 22.06-rc/modprobe.sh
rename to 22.06-rc/cli/modprobe.sh
diff --git a/22.06-rc/dind-rootless/Dockerfile b/22.06-rc/dind-rootless/Dockerfile
index c867d9bf7..60f376b43 100644
--- a/22.06-rc/dind-rootless/Dockerfile
+++ b/22.06-rc/dind-rootless/Dockerfile
@@ -29,10 +29,10 @@ RUN set -eux; \
 		'aarch64') \
 			url='https://download.docker.com/linux/static/test/aarch64/docker-rootless-extras-22.06.0-beta.0.tgz'; \
 			;; \
-		*) echo >&2 "error: unsupported architecture ($apkArch)"; exit 1 ;; \
+		*) echo >&2 "error: unsupported 'rootless.tgz' architecture ($apkArch)"; exit 1 ;; \
 	esac; \
 	\
-	wget -O rootless.tgz "$url"; \
+	wget -O 'rootless.tgz' "$url"; \
 	\
 	tar --extract \
 		--file rootless.tgz \
diff --git a/22.06-rc/dind/Dockerfile b/22.06-rc/dind/Dockerfile
index 8b64f8e00..a3cd746e6 100644
--- a/22.06-rc/dind/Dockerfile
+++ b/22.06-rc/dind/Dockerfile
@@ -4,7 +4,7 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM docker:22.06-rc
+FROM docker:22.06-rc-cli
 
 # https://github.com/docker/docker/blob/master/project/PACKAGERS.md#runtime-dependencies
 RUN set -eux; \
@@ -37,6 +37,42 @@ RUN set -eux; \
 	echo 'dockremap:165536:65536' >> /etc/subuid; \
 	echo 'dockremap:165536:65536' >> /etc/subgid
 
+RUN set -eux; \
+	\
+	apkArch="$(apk --print-arch)"; \
+	case "$apkArch" in \
+		'x86_64') \
+			url='https://download.docker.com/linux/static/test/x86_64/docker-22.06.0-beta.0.tgz'; \
+			;; \
+		'armhf') \
+			url='https://download.docker.com/linux/static/test/armel/docker-22.06.0-beta.0.tgz'; \
+			;; \
+		'armv7') \
+			url='https://download.docker.com/linux/static/test/armhf/docker-22.06.0-beta.0.tgz'; \
+			;; \
+		'aarch64') \
+			url='https://download.docker.com/linux/static/test/aarch64/docker-22.06.0-beta.0.tgz'; \
+			;; \
+		*) echo >&2 "error: unsupported 'docker.tgz' architecture ($apkArch)"; exit 1 ;; \
+	esac; \
+	\
+	wget -O 'docker.tgz' "$url"; \
+	\
+	tar --extract \
+		--file docker.tgz \
+		--strip-components 1 \
+		--directory /usr/local/bin/ \
+		--no-same-owner \
+# we exclude the CLI binary because we already extracted that over in the "docker:22.06-rc-cli" image that we're FROM and we don't want to duplicate those bytes again in this layer
+		--exclude 'docker/docker' \
+	; \
+	rm docker.tgz; \
+	\
+	dockerd --version; \
+	containerd --version; \
+	ctr --version; \
+	runc --version
+
 # https://github.com/docker/docker/tree/master/hack/dind
 ENV DIND_COMMIT 42b1175eda071c0e9121e1d64345928384a93df1
 
diff --git a/22.06-rc/git/Dockerfile b/22.06-rc/git/Dockerfile
index 52b3e92af..632854d75 100644
--- a/22.06-rc/git/Dockerfile
+++ b/22.06-rc/git/Dockerfile
@@ -4,6 +4,6 @@
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
 
-FROM docker:22.06-rc
+FROM docker:22.06-rc-cli
 
 RUN apk add --no-cache git
diff --git a/Dockerfile.template b/Dockerfile-cli.template
similarity index 59%
rename from Dockerfile.template
rename to Dockerfile-cli.template
index c0d8ce3ad..64d7afd97 100644
--- a/Dockerfile.template
+++ b/Dockerfile-cli.template
@@ -1,3 +1,4 @@
+{{ include "shared" -}}
 FROM alpine:3.16
 
 RUN apk add --no-cache \
@@ -14,59 +15,27 @@ RUN apk add --no-cache \
 RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
 
 ENV DOCKER_VERSION {{ .version }}
-# TODO ENV DOCKER_SHA256
-# https://github.com/docker/docker-ce/blob/5b073ee2cf564edee5adca05eee574142f7627bb/components/packaging/static/hash_files !!
-# (no SHA file artifacts on download.docker.com yet as of 2017-06-07 though)
 
-{{
-	def apkArch:
-		{
-			# https://dl-cdn.alpinelinux.org/alpine/edge/main/
-			# https://wiki.alpinelinux.org/wiki/Architecture#Alpine_Hardware_Architecture_.28.22arch.22.29_Support
-			# https://pkgs.alpinelinux.org/packages ("Arch" dropdown)
-			amd64: "x86_64",
-			arm32v6: "armhf",
-			arm32v7: "armv7",
-			arm64v8: "aarch64",
-			i386: "x86",
-			ppc64le: "ppc64le",
-			riscv64: "riscv64",
-			s390x: "s390x",
-		}[.]
--}}
 RUN set -eux; \
 	\
-	apkArch="$(apk --print-arch)"; \
-	case "$apkArch" in \
-{{
-	[
-		.arches | to_entries[]
-		| .key as $bashbrewArch
-		| ($bashbrewArch | apkArch) as $apkArch
-		| .value
-		| select($apkArch and .dockerUrl)
-		| (
--}}
-		{{ $apkArch | @sh }}) \
-			url={{ .dockerUrl | @sh }}; \
-			;; \
-{{
-		)
-	] | add
--}}
-		*) echo >&2 "error: unsupported architecture ($apkArch)"; exit 1 ;; \
-	esac; \
-	\
-	wget -O docker.tgz "$url"; \
+	{{
+		download({
+			arches: .arches,
+			urlKey: "dockerUrl",
+			# TODO sha256Key (once Docker publishes them 😭)
+			target: "docker.tgz",
+		})
+	}}; \
 	\
 	tar --extract \
 		--file docker.tgz \
 		--strip-components 1 \
 		--directory /usr/local/bin/ \
+		--no-same-owner \
+		'docker/docker' \
 	; \
 	rm docker.tgz; \
 	\
-	dockerd --version; \
 	docker --version
 {{
 	{
@@ -79,31 +48,22 @@ RUN set -eux; \
 
 ENV DOCKER_{{ $key | ascii_upcase }}_VERSION {{ .version }}
 RUN set -eux; \
-	apkArch="$(apk --print-arch)"; \
-	case "$apkArch" in \
-{{
-			.arches | to_entries | map(
-				.key as $bashbrewArch
-				| ($bashbrewArch | apkArch) as $apkArch
-				| .value
-				| select($apkArch and .url and .sha256)
-				| (
--}}
-		{{ $apkArch | @sh }}) \
-			url={{ .url | @sh }}; \
-			sha256={{ .sha256 | @sh }}; \
-			;; \
-{{
-				)
-			) | add
--}}
-		*) echo >&2 "warning: unsupported {{ $key }} architecture ($apkArch); skipping"; exit 0 ;; \
-	esac; \
+	\
+	{{
+		download({
+			arches: .arches,
+			urlKey: "url",
+			sha256Key: "sha256",
+			target: ("docker-" + $key),
+			missingArchWarning: true,
+		})
+	}}; \
+	\
 	plugin='/usr/libexec/docker/cli-plugins/docker-{{ $key }}'; \
 	mkdir -p "$(dirname "$plugin")"; \
-	wget -O "$plugin" "$url"; \
-	echo "$sha256 *$plugin" | sha256sum -c -; \
+	mv -vT {{ "docker-" + $key | @sh }} "$plugin"; \
 	chmod +x "$plugin"; \
+	\
 {{ if $key == "compose" then ( -}}
 	ln -sv "$plugin" /usr/local/bin/; \
 	docker-{{ $key }} --version; \
diff --git a/Dockerfile-dind-rootless.template b/Dockerfile-dind-rootless.template
index 896fb8dac..3d9c76782 100644
--- a/Dockerfile-dind-rootless.template
+++ b/Dockerfile-dind-rootless.template
@@ -1,3 +1,4 @@
+{{ include "shared" -}}
 FROM docker:{{ env.version }}-dind
 
 # busybox "ip" is insufficient:
@@ -15,36 +16,14 @@ RUN set -eux; \
 
 RUN set -eux; \
 	\
-	apkArch="$(apk --print-arch)"; \
-	case "$apkArch" in \
-{{
-	[
-		.arches | to_entries[]
-		| select(.value.rootlessExtrasUrl)
-		| .key as $bashbrewArch
-		| (
-			{
-				amd64: "x86_64",
-				arm32v6: "armhf",
-				arm32v7: "armv7",
-				arm64v8: "aarch64",
-			}
-			| .[$bashbrewArch] // $bashbrewArch
-		) as $apkArch
-		| .value
-		| (
--}}
-		{{ $apkArch | @sh }}) \
-			url={{ .rootlessExtrasUrl | @sh }}; \
-			;; \
-{{
-		)
-	] | add
--}}
-		*) echo >&2 "error: unsupported architecture ($apkArch)"; exit 1 ;; \
-	esac; \
-	\
-	wget -O rootless.tgz "$url"; \
+	{{
+		download({
+			arches: .arches,
+			urlKey: "rootlessExtrasUrl",
+			# TODO sha256Key (once Docker publishes them 😭)
+			target: "rootless.tgz",
+		})
+	}}; \
 	\
 	tar --extract \
 		--file rootless.tgz \
diff --git a/Dockerfile-dind.template b/Dockerfile-dind.template
index 668215964..f8b585328 100644
--- a/Dockerfile-dind.template
+++ b/Dockerfile-dind.template
@@ -1,4 +1,5 @@
-FROM docker:{{ env.version }}
+{{ include "shared" -}}
+FROM docker:{{ env.version }}-cli
 
 # https://github.com/docker/docker/blob/master/project/PACKAGERS.md#runtime-dependencies
 RUN set -eux; \
@@ -31,6 +32,32 @@ RUN set -eux; \
 	echo 'dockremap:165536:65536' >> /etc/subuid; \
 	echo 'dockremap:165536:65536' >> /etc/subgid
 
+RUN set -eux; \
+	\
+	{{
+		download({
+			arches: .arches,
+			urlKey: "dockerUrl",
+			# TODO sha256Key (once Docker publishes them 😭)
+			target: "docker.tgz",
+		})
+	}}; \
+	\
+	tar --extract \
+		--file docker.tgz \
+		--strip-components 1 \
+		--directory /usr/local/bin/ \
+		--no-same-owner \
+# we exclude the CLI binary because we already extracted that over in the "docker:{{ env.version }}-cli" image that we're FROM and we don't want to duplicate those bytes again in this layer
+		--exclude 'docker/docker' \
+	; \
+	rm docker.tgz; \
+	\
+	dockerd --version; \
+	containerd --version; \
+	ctr --version; \
+	runc --version
+
 # https://github.com/docker/docker/tree/master/hack/dind
 ENV DIND_COMMIT {{ .dindCommit }}
 
diff --git a/Dockerfile-git.template b/Dockerfile-git.template
index 0bf1a1ce4..40606acc2 100644
--- a/Dockerfile-git.template
+++ b/Dockerfile-git.template
@@ -1,3 +1,3 @@
-FROM docker:{{ env.version }}
+FROM docker:{{ env.version }}-cli
 
 RUN apk add --no-cache git
diff --git a/apply-templates.sh b/apply-templates.sh
index e74505a94..706c4adec 100755
--- a/apply-templates.sh
+++ b/apply-templates.sh
@@ -36,11 +36,13 @@ for version; do
 		continue
 	fi
 
+	rm -rf "$version"
+
 	variants="$(jq -r '.[env.version].variants | map(@sh) | join(" ")' versions.json)"
 	eval "variants=( $variants )"
 
 	for variant in "${variants[@]}"; do
-		dir="$version${variant:+/$variant}"
+		dir="$version/$variant"
 
 		case "$variant" in
 			windows/*)
@@ -53,7 +55,7 @@ for version; do
 				;;
 
 			*)
-				template="Dockerfile${variant:+-$variant}.template"
+				template="Dockerfile-$variant.template"
 				;;
 		esac
 
@@ -64,6 +66,6 @@ for version; do
 		} > "$dir/Dockerfile"
 	done
 
-	cp -a docker-entrypoint.sh modprobe.sh "$version/"
+	cp -a docker-entrypoint.sh modprobe.sh "$version/cli/"
 	cp -a dockerd-entrypoint.sh "$version/dind/"
 done
diff --git a/generate-stackbrew-library.sh b/generate-stackbrew-library.sh
index a205d0eb0..a54c64643 100755
--- a/generate-stackbrew-library.sh
+++ b/generate-stackbrew-library.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-set -eu
+#!/usr/bin/env bash
+set -Eeuo pipefail
 
 self="$(basename "$BASH_SOURCE")"
 cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
@@ -72,7 +72,7 @@ versionArches() {
 	fi
 
 	local parent parentArches
-	parent="$(awk 'toupper($1) == "FROM" { print $2 }' "$version/Dockerfile")"
+	parent="$(awk 'toupper($1) == "FROM" { print $2 }' "$version/cli/Dockerfile")"
 	parentArches="${parentRepoToArches[$parent]:-}"
 
 	comm -12 \
@@ -157,23 +157,35 @@ for version; do
 	variants="$(jq -r '.[env.version].variants | map(@sh) | join(" ")' versions.json)"
 	eval "variants=( $variants )"
 
+	case "$rcVersion" in
+		20.10) latestVariant='cli' ;;
+		*)     latestVariant='dind' ;;
+	esac
+
 	for v in "${variants[@]}"; do
-		dir="$version${v:+/$v}"
+		dir="$version/$v"
 		[ -f "$dir/Dockerfile" ] || continue
 
 		commit="$(dirCommit "$dir")"
 
 		variant="$(basename "$v")"
-		variantAliases=( "${versionAliases[@]/%/${variant:+-$variant}}" )
+		variantAliases=( "${versionAliases[@]/%/-$variant}" )
 		variantAliases=( "${variantAliases[@]//latest-/}" )
 
-		if [ "$variant" = '' ] || [ "$variant" = 'dind' ]; then
-			parent="$(awk 'toupper($1) == "FROM" { print $2 }' "$version/Dockerfile")"
+		if [ "$variant" = 'cli' ] || [ "$variant" = 'dind' ]; then
+			parent="$(awk 'toupper($1) == "FROM" { print $2 }' "$version/cli/Dockerfile")"
 			alpine="${parent#*:}" # "3.14"
 			suiteAliases=( "${variantAliases[0]}" ) # only "X.Y.Z-foo"
 			suiteAliases=( "${suiteAliases[@]/%/-alpine$alpine}" )
 			suiteAliases=( "${suiteAliases[@]//latest-/}" )
 			variantAliases+=( "${suiteAliases[@]}" )
+			if [ "$variant" = "$latestVariant" ]; then
+				# add "latest" aliases
+				suiteAliases=( "${versionAliases[0]}" ) # only "X.Y.Z-foo"
+				suiteAliases=( "${suiteAliases[@]/%/-alpine$alpine}" )
+				suiteAliases=( "${suiteAliases[@]//latest-/}" )
+				variantAliases+=( "${versionAliases[@]}" "${suiteAliases[@]}" )
+			fi
 		fi
 
 		sharedTags=()
diff --git a/shared.jq b/shared.jq
new file mode 100644
index 000000000..c3213117e
--- /dev/null
+++ b/shared.jq
@@ -0,0 +1,67 @@
+# converts a bashbrew architecture to apk's strings
+def apkArch:
+	{
+		# https://dl-cdn.alpinelinux.org/alpine/edge/main/
+		# https://wiki.alpinelinux.org/wiki/Architecture#Alpine_Hardware_Architecture_.28.22arch.22.29_Support
+		# https://pkgs.alpinelinux.org/packages ("Arch" dropdown)
+		amd64: "x86_64",
+		arm32v6: "armhf",
+		arm32v7: "armv7",
+		arm64v8: "aarch64",
+		i386: "x86",
+		ppc64le: "ppc64le",
+		riscv64: "riscv64",
+		s390x: "s390x",
+	}[.]
+	;
+
+# RUN set -eux; \
+# 	...
+# 	{{
+# 		download({
+# 			arches: .arches,
+# 			urlKey: "dockerUrl",
+# 			#sha256Key: "sha256",
+# 			target: "docker.tgz",
+# 			#missingArchWarning: true,
+# 		})
+# 	}}; \
+# 	...
+def download(opts):
+	(opts.sha256Key | not) as $notSha256
+	| [
+	"apkArch=\"$(apk --print-arch)\";
+	case \"$apkArch\" in"
+		,
+		(
+		opts.arches | to_entries[]
+		| .key as $bashbrewArch
+		| ($bashbrewArch | apkArch) as $apkArch
+		| .value
+		| .[opts.urlKey] as $url
+		| (if $notSha256 then "none" else .[opts.sha256Key] end) as $sha256
+		| select($apkArch and $url and $sha256)
+		| ("
+		\($apkArch | @sh))
+			url=\($url | @sh);"
+			+ if $notSha256 then "" else "
+			sha256=\($sha256 | @sh);"
+			end + "
+			;;"
+			)
+		)
+		,
+		"
+		*) echo >&2 \"\(if opts.missingArchWarning then "warning" else "error" end): unsupported \(opts.target | @sh) architecture ($apkArch)\(if opts.missingArchWarning then "; skipping" else "" end)\"; exit \(if opts.missingArchWarning then 0 else 1 end) ;;
+	esac;
+	
+	wget -O \(opts.target | @sh) \"$url\";"
+	,
+	if $notSha256 then "" else "
+	echo \"$sha256 *\"\(opts.target | @sh) | sha256sum -c -;"
+	end
+	] | add
+	| rtrimstr(";")
+	| gsub("(?<=[^[:space:]])\n"; " \\\n")
+	| gsub("(?<=[[:space:]])\n"; "\\\n")
+	;
diff --git a/versions.json b/versions.json
index 62baa3dcc..a203d05e1 100644
--- a/versions.json
+++ b/versions.json
@@ -121,7 +121,7 @@
     },
     "dindCommit": "42b1175eda071c0e9121e1d64345928384a93df1",
     "variants": [
-      "",
+      "cli",
       "dind",
       "dind-rootless",
       "git",
@@ -254,7 +254,7 @@
     },
     "dindCommit": "42b1175eda071c0e9121e1d64345928384a93df1",
     "variants": [
-      "",
+      "cli",
       "dind",
       "dind-rootless",
       "git",
diff --git a/versions.sh b/versions.sh
index 61969cea5..a5ab0551c 100755
--- a/versions.sh
+++ b/versions.sh
@@ -250,7 +250,7 @@ for version in "${versions[@]}"; do
 
 	# order here controls the order of the library/ file
 	for variant in \
-		'' \
+		cli \
 		dind \
 		dind-rootless \
 		git \