diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000000..8d9b72f3a3
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,34 @@
+# NOTE(dperny): for some reason, alpine was giving me trouble
+FROM golang:1.10.3-stretch
+
+RUN apt-get update && apt-get install -y make git unzip
+
+# make a directory to do these operations in
+RUN mkdir -p protoc && cd protoc && \
+  # download the pre-built protoc binary
+  curl --silent --show-error --location --output protoc.zip \
+  https://github.com/google/protobuf/releases/download/v3.5.0/protoc-3.5.0-linux-x86_64.zip \
+  # move the binary to /bin. move the well-known types ot /usr/local/include
+  && unzip protoc.zip && mv bin/protoc /bin/protoc && mv include/* /usr/local/include \
+  # remove all of the files
+  && rmdir bin && rmdir include && rm readme.txt \
+  # remove the zip file. go back up one level and remove the now-empty
+  # directory protoc
+  && rm protoc.zip && cd .. && rmdir protoc
+
+# This is sort of a workaround... basically, we want to be able to install all
+# of the dependencies specified in `make setup`. But if we wait until after we
+# copy code over, we'll bust the cache and reinstall these dependencies every
+# time, which would be bad. This is a common problem in docker.
+RUN go get -u github.com/golang/lint/golint &&\
+  go get -u github.com/gordonklaus/ineffassign &&\
+  go get -u github.com/client9/misspell/cmd/misspell &&\
+  go get -u github.com/lk4d4/vndr &&\
+  go get -u github.com/stevvooe/protobuild
+
+WORKDIR /go/src/github.com/docker/swarmkit/
+COPY . .
+
+# default to just `make`. If you want to change the default command, change the
+# default make command, not this command.
+CMD ["make"]
diff --git a/Makefile b/Makefile
index b9dbdd3d3a..a751b97f46 100644
--- a/Makefile
+++ b/Makefile
@@ -24,136 +24,14 @@ VNDR=$(shell which vndr || echo '')
 
 GO_LDFLAGS=-ldflags "-X `go list ./version`.Version=$(VERSION)"
 
-.PHONY: clean all AUTHORS fmt vet lint build binaries test integration setup generate protos checkprotos coverage ci check help install uninstall dep-validate
-.DEFAULT: default
+# stop here. do we want to run everything inside of a container, or do we want
+# to run it directly on the host? if the user has set ANY non-empty value for
+# the variable SWARMKIT_USE_CONTAINER, then we do all of the making inside of
+# a container. We will default to using no container, to avoid breaking
+# anyone's workflow
+ifndef SWARMKIT_USE_CONTAINER
+include direct.mk
+else
+include containerized.mk
+endif
 
-all: check binaries test integration ## run fmt, vet, lint, build the binaries and run the tests
-
-check: fmt vet lint ineffassign misspell ## run fmt, vet, lint, ineffassign, misspell
-
-ci: check binaries checkprotos coverage coverage-integration ## to be used by the CI
-
-AUTHORS: .mailmap .git/HEAD
-	git log --format='%aN <%aE>' | sort -fu > $@
-
-# This only needs to be generated by hand when cutting full releases.
-version/version.go:
-	./version/version.sh > $@
-
-setup: ## install dependencies
-	@echo "🐳 $@"
-	# TODO(stevvooe): Install these from the vendor directory
-	@go get -u github.com/golang/lint/golint
-	#@go get -u github.com/kisielk/errcheck
-	@go get -u github.com/gordonklaus/ineffassign
-	@go get -u github.com/client9/misspell/cmd/misspell
-	@go get -u github.com/lk4d4/vndr
-	@go get -u github.com/stevvooe/protobuild
-
-generate: protos
-	@echo "🐳 $@"
-	@PATH=${ROOTDIR}/bin:${PATH} go generate -x ${PACKAGES}
-
-protos: bin/protoc-gen-gogoswarm ## generate protobuf
-	@echo "🐳 $@"
-	@PATH=${ROOTDIR}/bin:${PATH} protobuild ${PACKAGES}
-
-checkprotos: generate ## check if protobufs needs to be generated again
-	@echo "🐳 $@"
-	@test -z "$$(git status --short | grep ".pb.go" | tee /dev/stderr)" || \
-		((git diff | cat) && \
-		(echo "👹 please run 'make generate' when making changes to proto files" && false))
-
-# Depends on binaries because vet will silently fail if it can't load compiled
-# imports
-vet: binaries ## run go vet
-	@echo "🐳 $@"
-	@test -z "$$(go vet ${PACKAGES} 2>&1 | grep -v 'constant [0-9]* not a string in call to Errorf' | egrep -v '(timestamp_test.go|duration_test.go|exit status 1)' | tee /dev/stderr)"
-
-misspell:
-	@echo "🐳 $@"
-	@test -z "$$(find . -type f | grep -v vendor/ | grep -v bin/ | grep -v .git/ | grep -v MAINTAINERS | xargs misspell | tee /dev/stderr)"
-
-fmt: ## run go fmt
-	@echo "🐳 $@"
-	@test -z "$$(gofmt -s -l . | grep -v vendor/ | grep -v ".pb.go$$" | tee /dev/stderr)" || \
-		(echo "👹 please format Go code with 'gofmt -s -w'" && false)
-	@test -z "$$(find . -path ./vendor -prune -o ! -name timestamp.proto ! -name duration.proto -name '*.proto' -type f -exec grep -Hn -e "^ " {} \; | tee /dev/stderr)" || \
-		(echo "👹 please indent proto files with tabs only" && false)
-	@test -z "$$(find . -path ./vendor -prune -o -name '*.proto' -type f -exec grep -Hn "Meta meta = " {} \; | grep -v '(gogoproto.nullable) = false' | tee /dev/stderr)" || \
-		(echo "👹 meta fields in proto files must have option (gogoproto.nullable) = false" && false)
-
-lint: ## run go lint
-	@echo "🐳 $@"
-	@test -z "$$(golint ./... | grep -v vendor/ | grep -v ".pb.go:" | tee /dev/stderr)"
-
-ineffassign: ## run ineffassign
-	@echo "🐳 $@"
-	@test -z "$$(ineffassign . | grep -v vendor/ | grep -v ".pb.go:" | tee /dev/stderr)"
-
-#errcheck: ## run go errcheck
-#	@echo "🐳 $@"
-#	@test -z "$$(errcheck ./... | grep -v vendor/ | grep -v ".pb.go:" | tee /dev/stderr)"
-
-build: ## build the go packages
-	@echo "🐳 $@"
-	@go build -i -tags "${DOCKER_BUILDTAGS}" -v ${GO_LDFLAGS} ${GO_GCFLAGS} ${PACKAGES}
-
-test: ## run tests, except integration tests
-	@echo "🐳 $@"
-	@go test -parallel 8 ${RACE} -tags "${DOCKER_BUILDTAGS}" $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})
-
-integration: ## run integration tests
-	@echo "🐳 $@"
-	@go test -parallel 8 ${RACE} -tags "${DOCKER_BUILDTAGS}" ${INTEGRATION_PACKAGE}
-
-FORCE:
-
-# Build a binary from a cmd.
-bin/%: cmd/% FORCE
-	@test $$(go list) = "${PROJECT_ROOT}" || \
-		(echo "👹 Please correctly set up your Go build environment. This project must be located at <GOPATH>/src/${PROJECT_ROOT}" && false)
-	@echo "🐳 $@"
-	@go build -i -tags "${DOCKER_BUILDTAGS}" -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./$<
-
-binaries: $(BINARIES) ## build binaries
-	@echo "🐳 $@"
-
-clean: ## clean up binaries
-	@echo "🐳 $@"
-	@rm -f $(BINARIES)
-
-install: $(BINARIES) ## install binaries
-	@echo "🐳 $@"
-	@mkdir -p $(DESTDIR)/bin
-	@install $(BINARIES) $(DESTDIR)/bin
-
-uninstall:
-	@echo "🐳 $@"
-	@rm -f $(addprefix $(DESTDIR)/bin/,$(notdir $(BINARIES)))
-
-coverage: ## generate coverprofiles from the unit tests
-	@echo "🐳 $@"
-	@( for pkg in $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES}); do \
-		go test -i ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../$$pkg/coverage.txt" -covermode=atomic $$pkg || exit; \
-		go test ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../$$pkg/coverage.txt" -covermode=atomic $$pkg || exit; \
-	done )
-
-coverage-integration: ## generate coverprofiles from the integration tests
-	@echo "🐳 $@"
-	go test ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../${INTEGRATION_PACKAGE}/coverage.txt" -covermode=atomic ${INTEGRATION_PACKAGE}
-
-help: ## this help
-	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST) | sort
-
-dep-validate:
-	@echo "+ $@"
-	$(if $(VNDR), , \
-		$(error Please install vndr: go get github.com/lk4d4/vndr))
-	@rm -Rf .vendor.bak
-	@mv vendor .vendor.bak
-	@$(VNDR)
-	@test -z "$$(diff -r vendor .vendor.bak 2>&1 | tee /dev/stderr)" || \
-		(echo >&2 "+ inconsistent dependencies! what you have in vendor.conf does not match with what you have in vendor" && false)
-	@rm -Rf vendor
-	@mv .vendor.bak vendor
diff --git a/containerized.mk b/containerized.mk
new file mode 100644
index 0000000000..2b2dca238d
--- /dev/null
+++ b/containerized.mk
@@ -0,0 +1,14 @@
+# .PHONY: clean all AUTHORS fmt vet lint build binaries test integration setup generate protos checkprotos coverage ci check help install uninstall dep-validate image
+.PHONY: image
+
+IMAGE_NAME=docker/swarmkit
+DOCKER_IMAGE_DIR=/go/src/${PROJECT_ROOT}
+
+# don't bother writing every single make target. just pass the call through to
+# docker and make
+.DEFAULT: image
+	@echo "running target $@ inside a container"
+	docker run -it -v ${ROOTDIR}:${DOCKER_IMAGE_DIR} ${IMAGE_NAME} make $@
+
+image:
+	docker build -t ${IMAGE_NAME} .
diff --git a/direct.mk b/direct.mk
new file mode 100644
index 0000000000..743b28f5b2
--- /dev/null
+++ b/direct.mk
@@ -0,0 +1,133 @@
+.PHONY: clean all AUTHORS fmt vet lint build binaries test integration setup generate protos checkprotos coverage ci check help install uninstall dep-validate
+.DEFAULT: default
+
+all: check binaries test integration ## run fmt, vet, lint, build the binaries and run the tests
+
+check: fmt vet lint ineffassign misspell ## run fmt, vet, lint, ineffassign, misspell
+
+ci: check binaries checkprotos coverage coverage-integration ## to be used by the CI
+
+AUTHORS: .mailmap .git/HEAD
+	git log --format='%aN <%aE>' | sort -fu > $@
+
+# This only needs to be generated by hand when cutting full releases.
+version/version.go:
+	./version/version.sh > $@
+
+setup: ## install dependencies
+	@echo "🐳 $@"
+	# TODO(stevvooe): Install these from the vendor directory
+	@go get -u github.com/golang/lint/golint
+	#@go get -u github.com/kisielk/errcheck
+	@go get -u github.com/gordonklaus/ineffassign
+	@go get -u github.com/client9/misspell/cmd/misspell
+	@go get -u github.com/lk4d4/vndr
+	@go get -u github.com/stevvooe/protobuild
+
+generate: protos
+	@echo "🐳 $@"
+	@PATH=${ROOTDIR}/bin:${PATH} go generate -x ${PACKAGES}
+
+protos: bin/protoc-gen-gogoswarm ## generate protobuf
+	@echo "🐳 $@"
+	@PATH=${ROOTDIR}/bin:${PATH} protobuild ${PACKAGES}
+
+checkprotos: generate ## check if protobufs needs to be generated again
+	@echo "🐳 $@"
+	@test -z "$$(git status --short | grep ".pb.go" | tee /dev/stderr)" || \
+		((git diff | cat) && \
+		(echo "👹 please run 'make generate' when making changes to proto files" && false))
+
+# Depends on binaries because vet will silently fail if it can't load compiled
+# imports
+vet: binaries ## run go vet
+	@echo "🐳 $@"
+	@test -z "$$(go vet ${PACKAGES} 2>&1 | grep -v 'constant [0-9]* not a string in call to Errorf' | egrep -v '(timestamp_test.go|duration_test.go|exit status 1)' | tee /dev/stderr)"
+
+misspell:
+	@echo "🐳 $@"
+	@test -z "$$(find . -type f | grep -v vendor/ | grep -v bin/ | grep -v .git/ | grep -v MAINTAINERS | xargs misspell | tee /dev/stderr)"
+
+fmt: ## run go fmt
+	@echo "🐳 $@"
+	@test -z "$$(gofmt -s -l . | grep -v vendor/ | grep -v ".pb.go$$" | tee /dev/stderr)" || \
+		(echo "👹 please format Go code with 'gofmt -s -w'" && false)
+	@test -z "$$(find . -path ./vendor -prune -o ! -name timestamp.proto ! -name duration.proto -name '*.proto' -type f -exec grep -Hn -e "^ " {} \; | tee /dev/stderr)" || \
+		(echo "👹 please indent proto files with tabs only" && false)
+	@test -z "$$(find . -path ./vendor -prune -o -name '*.proto' -type f -exec grep -Hn "Meta meta = " {} \; | grep -v '(gogoproto.nullable) = false' | tee /dev/stderr)" || \
+		(echo "👹 meta fields in proto files must have option (gogoproto.nullable) = false" && false)
+
+lint: ## run go lint
+	@echo "🐳 $@"
+	@test -z "$$(golint ./... | grep -v vendor/ | grep -v ".pb.go:" | tee /dev/stderr)"
+
+ineffassign: ## run ineffassign
+	@echo "🐳 $@"
+	@test -z "$$(ineffassign . | grep -v vendor/ | grep -v ".pb.go:" | tee /dev/stderr)"
+
+#errcheck: ## run go errcheck
+#	@echo "🐳 $@"
+#	@test -z "$$(errcheck ./... | grep -v vendor/ | grep -v ".pb.go:" | tee /dev/stderr)"
+
+build: ## build the go packages
+	@echo "🐳 $@"
+	@go build -i -tags "${DOCKER_BUILDTAGS}" -v ${GO_LDFLAGS} ${GO_GCFLAGS} ${PACKAGES}
+
+test: ## run tests, except integration tests
+	@echo "🐳 $@"
+	@go test -parallel 8 ${RACE} -tags "${DOCKER_BUILDTAGS}" $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})
+
+integration: ## run integration tests
+	@echo "🐳 $@"
+	@go test -parallel 8 ${RACE} -tags "${DOCKER_BUILDTAGS}" ${INTEGRATION_PACKAGE}
+
+FORCE:
+
+# Build a binary from a cmd.
+bin/%: cmd/% FORCE
+	@test $$(go list) = "${PROJECT_ROOT}" || \
+		(echo "👹 Please correctly set up your Go build environment. This project must be located at <GOPATH>/src/${PROJECT_ROOT}" && false)
+	@echo "🐳 $@"
+	@go build -i -tags "${DOCKER_BUILDTAGS}" -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./$<
+
+binaries: $(BINARIES) ## build binaries
+	@echo "🐳 $@"
+
+clean: ## clean up binaries
+	@echo "🐳 $@"
+	@rm -f $(BINARIES)
+
+install: $(BINARIES) ## install binaries
+	@echo "🐳 $@"
+	@mkdir -p $(DESTDIR)/bin
+	@install $(BINARIES) $(DESTDIR)/bin
+
+uninstall:
+	@echo "🐳 $@"
+	@rm -f $(addprefix $(DESTDIR)/bin/,$(notdir $(BINARIES)))
+
+coverage: ## generate coverprofiles from the unit tests
+	@echo "🐳 $@"
+	@( for pkg in $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES}); do \
+		go test -i ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../$$pkg/coverage.txt" -covermode=atomic $$pkg || exit; \
+		go test ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../$$pkg/coverage.txt" -covermode=atomic $$pkg || exit; \
+	done )
+
+coverage-integration: ## generate coverprofiles from the integration tests
+	@echo "🐳 $@"
+	go test ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../${INTEGRATION_PACKAGE}/coverage.txt" -covermode=atomic ${INTEGRATION_PACKAGE}
+
+help: ## this help
+	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST) | sort
+
+dep-validate:
+	@echo "+ $@"
+	$(if $(VNDR), , \
+		$(error Please install vndr: go get github.com/lk4d4/vndr))
+	@rm -Rf .vendor.bak
+	@mv vendor .vendor.bak
+	@$(VNDR)
+	@test -z "$$(diff -r vendor .vendor.bak 2>&1 | tee /dev/stderr)" || \
+		(echo >&2 "+ inconsistent dependencies! what you have in vendor.conf does not match with what you have in vendor" && false)
+	@rm -Rf vendor
+	@mv .vendor.bak vendor