diff --git a/.gitignore b/.gitignore
index 2e8baba5f..560e22f2e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,6 @@ __debug*
 coverage*
 /tools/bin
 vendor/
+container_built.info
+go.local.mod
+go.local.sum
diff --git a/Makefile b/Makefile
index 8f1a20283..adf89762a 100644
--- a/Makefile
+++ b/Makefile
@@ -147,3 +147,52 @@ db-tests: dev-prerequisites
 
 .PHONY: test
 test: unit-tests db-tests
+
+# source where the other repos are locally
+# has to end with a trailing slash
+SRC_DEPS_EXTERNAL_CHECKOUT_DIR ?= ../
+
+DOCKER_IMAGE := image-builder_dev
+DOCKERFILE := distribution/Dockerfile-ubi.dev
+
+SRC_DEPS_EXTERNAL_NAMES := community-gateway osbuild-composer
+SRC_DEPS_EXTERNAL_DIRS := $(addprefix $(SRC_DEPS_EXTERNAL_CHECKOUT_DIR),$(SRC_DEPS_EXTERNAL_NAMES))
+
+SRC_DEPS_DIRS := internal cmd
+
+# All files to check for rebuild!
+SRC_DEPS := $(shell find $(SRC_DEPS_DIRS) -name *.go -or -name *.sql)
+SRC_DEPS_EXTERNAL := $(shell find $(SRC_DEPS_EXTERNAL_DIRS) -name *.go)
+
+CONTAINER_DEPS := ./distribution/openshift-startup.sh
+
+$(SRC_DEPS_EXTERNAL_DIRS):
+	@for DIR in $@; do if ! [ -d $$DIR ]; then echo "Please checkout $$DIR so it is available at $$DIR"; exit 1; fi; done
+
+GOPROXY ?= https://proxy.golang.org,direct
+
+GOMODARGS ?= -modfile=go.local.mod
+# gcflags "-N -l" for golang to allow debugging
+GCFLAGS ?= -gcflags=all=-N -gcflags=all=-l
+GOPATH ?= $(shell go env GOPATH)
+
+go.local.mod go.local.sum: $(SRC_DEPS_EXTERNAL_DIRS) go.mod $(SRC_DEPS_EXTERNAL) $(SRC_DEPS)
+	cp go.mod go.local.mod
+	cp go.sum go.local.sum
+	go mod edit $(GOMODARGS) -replace github.com/osbuild/osbuild-composer/pkg/splunk_logger=$(SRC_DEPS_EXTERNAL_CHECKOUT_DIR)osbuild-composer/pkg/splunk_logger
+	go mod edit $(GOMODARGS) -replace github.com/osbuild/community-gateway=$(SRC_DEPS_EXTERNAL_CHECKOUT_DIR)community-gateway
+	env GOPROXY=$(GOPROXY) go mod vendor $(GOMODARGS)
+
+container_built.info: go.local.mod $(DOCKERFILE) $(CONTAINER_DEPS) $(SRC_DEPS)
+	$(CONTAINER_EXECUTABLE) build -t $(DOCKER_IMAGE) -f $(DOCKERFILE) --build-arg GOMODARGS="$(GOMODARGS)" --build-arg GCFLAGS="$(GCFLAGS)" .
+	echo "Container last built on" > $@
+	date >> $@
+
+.PHONY: container.dev
+container.dev: container_built.info
+
+.PHONY: clean
+clean:
+	rm -f container_built.info
+	rm -f go.local.*
+
diff --git a/distribution/Dockerfile-ubi.dev b/distribution/Dockerfile-ubi.dev
new file mode 100644
index 000000000..e4f5ee280
--- /dev/null
+++ b/distribution/Dockerfile-ubi.dev
@@ -0,0 +1,37 @@
+# Use a builder container to build the Go application (which we extract in
+# the second container).
+FROM registry.access.redhat.com/ubi9/go-toolset:latest AS builder
+WORKDIR $GOPATH/go/src/github.com/osbuild/image-builder
+# ubi9/go-toolset defaults to uid 1001. Let's copy the files with this UID as well.
+# Otherwise, VCS stamping will fail because git >= 2.35.2 refuses to work in
+# a repository owned by a different user.
+COPY --chown=1001 . .
+ENV GOFLAGS=-mod=vendor
+
+ARG GOPROXY=https://proxy.golang.org,direct
+RUN go env -w GOPROXY=$GOPROXY
+
+ARG GOMODARGS=""
+ARG GCFLAGS=""
+
+RUN go install $GOMODARGS $GCFLAGS ./...
+
+FROM registry.access.redhat.com/ubi9/go-toolset:latest AS builder2
+RUN go install github.com/jackc/tern@latest
+
+# Build an extremely minimal container that only contains our Go application.
+FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
+RUN mkdir /app
+RUN mkdir -p "/opt/migrate/"
+
+COPY --from=builder /opt/app-root/src/go/bin/image-builder /app/
+COPY --from=builder /opt/app-root/src/go/bin/image-builder-migrate-db-tern /app/
+COPY ./distributions /app/distributions
+COPY ./internal/db/migrations-tern /app/migrations
+COPY ./distribution/openshift-startup.sh /opt/openshift-startup.sh
+COPY --from=builder2 /opt/app-root/src/go/bin/tern /opt/migrate/
+COPY --from=builder2 /usr/bin/dlv /usr/bin/dlv
+COPY --from=builder2 /usr/share/licenses/delve /usr/share/licenses/delve
+ENV TERN_MIGRATIONS_DIR=/app/migrations
+EXPOSE 8086
+CMD ["/opt/openshift-startup.sh"]
diff --git a/distribution/openshift-startup.sh b/distribution/openshift-startup.sh
index 4794d252e..6bcbe8aa0 100755
--- a/distribution/openshift-startup.sh
+++ b/distribution/openshift-startup.sh
@@ -3,6 +3,12 @@ set -euo pipefail
 
 if [[ -z "${KUBERNETES_PORT:-}" ]]; then
     echo "Starting image-builder inside container..."
+    if [[ -n "${GODEBUG_PORT:-}" ]]; then
+      echo "With golang debugger enabled on port ${GODEBUG_PORT} ..."
+      echo "NOTE: you HAVE to attach the debugger NOW otherwise the image-builder-backend will not continue running"
+      /usr/bin/dlv "--listen=:${GODEBUG_PORT}" --headless=true --api-version=2 exec /app/image-builder -- -v
+      exit $?
+    fi
 # we don't use cloudwatch in ephemeral environment for now
 elif [[ "${CLOWDER_ENABLED:=false}" == "true" ]]; then
     echo "Starting image-builder inside ephemeral environment..."