diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000..c2d5d03
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,100 @@
+name: Docker
+
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - "*"
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        distro: [centos-7, bionic]
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v2
+
+    - name: Set up docker buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v1
+      with:
+        version: latest
+
+    - name: Login to ghcr
+      uses: docker/login-action@v1
+      with:
+        registry: ghcr.io
+        username: ${{ secrets.CR_USERNAME }}
+        password: ${{ secrets.CR_PAT }}
+
+    - name: Build
+      uses: docker/build-push-action@v2
+      with:
+        file: ${{ matrix.distro }}/Dockerfile
+        context: .
+        push: true
+        tags: ghcr.io/nervosnetwork/ckb-docker-builder:${{ matrix.distro }}-${{ github.sha }}
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    needs: build
+
+    strategy:
+      matrix:
+        distro: [centos-7, bionic]
+
+    steps:
+    - name: Checkout CKB
+      uses: actions/checkout@v2
+      with:
+        repository: nervosnetwork/ckb
+        path: ckb
+
+    - name: Build CKB
+      run: |
+        docker run --rm -i -w /ckb -v $(pwd)/ckb:/ckb ghcr.io/nervosnetwork/ckb-docker-builder:${{ matrix.distro }}-${{ github.sha }} make prod
+
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+    needs: test
+    if: ${{ startsWith(github.ref, 'refs/tags/') }}
+
+    strategy:
+      matrix:
+        distro: [centos-7, bionic]
+
+    steps:
+    - name: Login to ghcr
+      uses: docker/login-action@v1
+      with:
+        registry: ghcr.io
+        username: ${{ secrets.CR_USERNAME }}
+        password: ${{ secrets.CR_PAT }}
+
+    - name: Login to DockerHub
+      uses: docker/login-action@v1 
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+    - name: Determine tag
+      id: tag
+      run: echo "::set-output name=tag::${GITHUB_REF##*/}"
+
+    - name: Tag and push image
+      uses: akhilerm/tag-push-action@v1.0.0
+      with:
+        src: ghcr.io/nervosnetwork/ckb-docker-builder:${{ matrix.distro }}-${{ github.sha }}
+        dst: |
+          ghcr.io/nervosnetwork/ckb-docker-builder:${{ matrix.distro }}-latest
+          ghcr.io/nervosnetwork/ckb-docker-builder:${{ matrix.distro }}-${{ steps.tag.outputs.tag }}
+          nervos/ckb-docker-builder:${{ matrix.distro }}-latest
+          nervos/ckb-docker-builder:${{ matrix.distro }}-${{ github.event.inputs.tag }}
diff --git a/.github/workflows/template.yml b/.github/workflows/template.yml
new file mode 100644
index 0000000..53224a6
--- /dev/null
+++ b/.github/workflows/template.yml
@@ -0,0 +1,16 @@
+name: Template Test
+
+on:
+  pull_request:
+  push:
+    branches:
+      - "*"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: python3 gen-dockerfiles
+      - run: git diff --exit-code
+
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..f4e3b5b
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/ckb
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..eae77f4
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,42 @@
+DOCKERHUB_REPO := nervos/ckb-docker-builder
+GHCR_REPO := ghcr.io/nervosnetwork/ckb-docker-builder
+IMAGE_VERSION := rust-$(shell sed -n "s/RUST_VERSION = '\(.*\)'$$/\1/p" gen-dockerfiles)
+
+bionic/Dockerfile: gen-dockerfiles templates/bionic.Dockerfile
+	python3 gen-dockerfiles
+
+centos-7/Dockerfile: gen-dockerfiles templates/centos-7.Dockerfile
+	python3 gen-dockerfiles
+
+build-all: build-bionic build-centos-7
+
+build-bionic: bionic/Dockerfile
+	docker build -f bionic/Dockerfile --tag ${DOCKERHUB_REPO}:bionic-${IMAGE_VERSION} .
+
+build-centos-7: centos-7/Dockerfile
+	docker build -f centos-7/Dockerfile --tag ${DOCKERHUB_REPO}:centos-7-${IMAGE_VERSION} .
+
+.PHONY: build-all build-bionic build-centos-7
+
+push-all: push-bionic push-centos-7
+
+push-bionic: build-bionic
+	docker push ${DOCKERHUB_REPO}:bionic-${IMAGE_VERSION}
+
+push-centos-7: build-centos-7
+	docker push ${DOCKERHUB_REPO}:centos-7-${IMAGE_VERSION}
+
+.PHONY: push-all push-bionic push-centos-7
+
+test-all: test-bionic test-centos-7
+
+sync-ckb:
+	if [ -d ckb ]; then git -C ckb pull; else git clone --depth 1 https://github.com/nervosnetwork/ckb.git; fi
+
+test-bionic: sync-ckb
+	docker --rm -it -w /ckb -v "$$(pwd)/ckb:/ckb" ${DOCKERHUB_REPO}:bionic-${IMAGE_VERSION} make prod
+
+test-centos-7: sync-ckb
+	docker --rm -it -w /ckb -v "$$(pwd)/ckb:/ckb" ${DOCKERHUB_REPO}:centos-7-${IMAGE_VERSION} make prod
+
+.PHONY: test-all test-bionic test-centos-7 sync-ckb
diff --git a/README.md b/README.md
index 70c8185..7f42834 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,6 @@ Environment for building [ckb](https://github.com/nervosnetwork/ckb#readme).
 - Update rustup version if needed in [`gen-dockerfiles`].
 - Update rust version in [`gen-dockerfiles`].
 - Run the script [`gen-dockerfiles`].
-- Commit and tag `rust-${RUST_VERSION}` such as `rust-1.38.0`.
+- Commit, tag `rust-${RUST_VERSION}` such as `rust-1.51.0`.
 
 [`gen-dockerfiles`]: gen-dockerfiles
diff --git a/bionic/Dockerfile b/bionic/Dockerfile
index 8736276..e00d64d 100644
--- a/bionic/Dockerfile
+++ b/bionic/Dockerfile
@@ -4,14 +4,13 @@ RUN set -eux; \
     apt-get update; \
     apt-get install -y --no-install-recommends \
         ca-certificates \
-        g++ \
         gcc \
+        g++ \
         libc6-dev \
         wget \
         libssl-dev \
         git \
-        pkg-config \
-        libclang-dev clang; \
+        pkg-config; \
     rm -rf /var/lib/apt/lists/*
 
 ENV RUSTUP_HOME=/usr/local/rustup \
diff --git a/centos-7/Dockerfile b/centos-7/Dockerfile
index d39de15..5a189a6 100644
--- a/centos-7/Dockerfile
+++ b/centos-7/Dockerfile
@@ -4,7 +4,7 @@ ENV PATH=/root/.cargo/bin:$PATH
 
 RUN set -eux; \
     yum install -y centos-release-scl; \
-    yum install -y git curl make gcc-c++ openssl-devel llvm-toolset-7; \
+    yum install -y git curl make openssl-devel devtoolset-7; \
     yum clean all; \
     rm -rf /var/cache/yum
 
@@ -30,3 +30,8 @@ RUN set -eux; \
     rustup --version; \
     cargo --version; \
     rustc --version;
+
+COPY centos-7/entrypoint.sh /
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["bash"]
diff --git a/centos-7/entrypoint.sh b/centos-7/entrypoint.sh
new file mode 100755
index 0000000..7ae17be
--- /dev/null
+++ b/centos-7/entrypoint.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+scl enable devtoolset-7 "$*"
diff --git a/gen-dockerfiles b/gen-dockerfiles
index 5008e4d..ac03b06 100755
--- a/gen-dockerfiles
+++ b/gen-dockerfiles
@@ -10,7 +10,7 @@ RUST_ARCH = 'x86_64-unknown-linux-gnu'
 
 DISTRIBUTIONS = [
     # Ubuntu
-    'xenial', 'bionic',
+    'bionic',
     # CentOS
     'centos-7',
 ]
diff --git a/templates/bionic.Dockerfile b/templates/bionic.Dockerfile
index d5b964a..ae1c3a4 100644
--- a/templates/bionic.Dockerfile
+++ b/templates/bionic.Dockerfile
@@ -5,12 +5,12 @@ RUN set -eux; \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         gcc \
+        g++ \
         libc6-dev \
         wget \
         libssl-dev \
         git \
-        pkg-config \
-        libclang-dev clang; \
+        pkg-config; \
     rm -rf /var/lib/apt/lists/*
 
 ENV RUSTUP_HOME=/usr/local/rustup \
diff --git a/templates/centos-7.Dockerfile b/templates/centos-7.Dockerfile
index f609933..d7dae77 100644
--- a/templates/centos-7.Dockerfile
+++ b/templates/centos-7.Dockerfile
@@ -4,7 +4,7 @@ ENV PATH=/root/.cargo/bin:$PATH
 
 RUN set -eux; \
     yum install -y centos-release-scl; \
-    yum install -y git curl make gcc-c++ openssl-devel llvm-toolset-7; \
+    yum install -y git curl make openssl-devel devtoolset-7; \
     yum clean all; \
     rm -rf /var/cache/yum
 
@@ -30,3 +30,8 @@ RUN set -eux; \
     rustup --version; \
     cargo --version; \
     rustc --version;
+
+COPY centos-7/entrypoint.sh /
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["bash"]
diff --git a/templates/xenial.Dockerfile b/templates/xenial.Dockerfile
deleted file mode 100644
index 3bfe51d..0000000
--- a/templates/xenial.Dockerfile
+++ /dev/null
@@ -1,52 +0,0 @@
-FROM ubuntu:xenial
-
-RUN set -eux; \
-    apt-get update; \
-    apt-get install -y --no-install-recommends \
-        ca-certificates \
-        gcc \
-        libc6-dev \
-        wget \
-        git \
-        pkg-config \
-        libclang-dev clang; \
-    rm -rf /var/lib/apt/lists/*
-
-ENV OPENSSL_VERSION=1.1.1c \
-    OPENSSL_SHA256=f6fb3079ad15076154eda9413fed42877d668e7069d9b87396d0804fdb3f4c90
-
-RUN set -eux; \
-    url="https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz"; \
-    wget "$url"; \
-    echo "${OPENSSL_SHA256} *openssl-${OPENSSL_VERSION}.tar.gz" | sha256sum -c -; \
-    tar -xzf "openssl-${OPENSSL_VERSION}.tar.gz"; \
-    cd openssl-${OPENSSL_VERSION}; \
-    ./config no-shared no-zlib -fPIC -DOPENSSL_NO_SECURE_MEMORY; \
-    make; \
-    make install; \
-    cd ..; \
-    rm -rf openssl-${OPENSSL_VERSION} openssl-${OPENSSL_VERSION}.tar.gz
-
-ENV RUSTUP_HOME=/usr/local/rustup \
-    CARGO_HOME=/usr/local/cargo \
-    PATH=/usr/local/cargo/bin:$PATH \
-    RUSTUP_VERSION=%%RUSTUP_VERSION%% \
-    RUSTUP_SHA256=%%RUSTUP_SHA256%% \
-    RUST_ARCH=%%RUST_ARCH%%
-
-RUN set -eux; \
-    url="https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${RUST_ARCH}/rustup-init"; \
-    wget "$url"; \
-    echo "${RUSTUP_SHA256} *rustup-init" | sha256sum -c -; \
-    chmod +x rustup-init
-
-ENV RUST_VERSION=%%RUST_VERSION%%
-
-RUN set -eux; \
-    ./rustup-init -y --no-modify-path --default-toolchain $RUST_VERSION; \
-    rm rustup-init; \
-    chmod -R a+w $RUSTUP_HOME $CARGO_HOME; \
-    rustup --version; \
-    cargo --version; \
-    rustc --version; \
-    openssl version;
diff --git a/xenial/Dockerfile b/xenial/Dockerfile
deleted file mode 100644
index 6e51aa1..0000000
--- a/xenial/Dockerfile
+++ /dev/null
@@ -1,73 +0,0 @@
-FROM ubuntu:xenial
-
-RUN set -eux; \
-    apt-get update; \
-    apt-get install -y --no-install-recommends wget software-properties-common apt-transport-https; \
-    wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add -; \
-    apt-add-repository "deb http://apt.llvm.org/xenial/ llvm-toolchain-xenial-5.0 main"; \
-    add-apt-repository -y ppa:ubuntu-toolchain-r/test; \
-    rm -rf /var/lib/apt/lists/*
-
-RUN set -eux; \
-    apt-get update; \
-    apt-get install -y --no-install-recommends \
-        ca-certificates \
-        gcc-7 \
-        g++-7 \
-        libc6-dev \
-        git \
-        pkg-config \
-        libclang-5.0-dev clang-5.0; \
-    update-alternatives \
-        --install /usr/bin/clang clang /usr/bin/clang-5.0 60 \
-        --slave /usr/bin/clang++ clang++ /usr/bin/clang++-5.0; \
-    update-alternatives \
-        --install /usr/bin/gcc gcc /usr/bin/gcc-7 60 \
-        --slave /usr/bin/g++ g++ /usr/bin/g++-7 \
-        --slave /usr/bin/gcov gcov /usr/bin/gcov-7 \
-        --slave /usr/bin/gcov-tool gcov-tool /usr/bin/gcov-tool-7 \
-        --slave /usr/bin/gcc-ar gcc-ar /usr/bin/gcc-ar-7 \
-        --slave /usr/bin/gcc-nm gcc-nm /usr/bin/gcc-nm-7 \
-        --slave /usr/bin/gcc-ranlib gcc-ranlib /usr/bin/gcc-ranlib-7; \
-    update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-7 60; \
-    update-alternatives --install /usr/bin/c++ c++ /usr/bin/g++-7 60; \
-    rm -rf /var/lib/apt/lists/*
-
-ENV OPENSSL_VERSION=1.1.1c \
-    OPENSSL_SHA256=f6fb3079ad15076154eda9413fed42877d668e7069d9b87396d0804fdb3f4c90
-
-RUN set -eux; \
-    url="https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz"; \
-    wget "$url"; \
-    echo "${OPENSSL_SHA256} *openssl-${OPENSSL_VERSION}.tar.gz" | sha256sum -c -; \
-    tar -xzf "openssl-${OPENSSL_VERSION}.tar.gz"; \
-    cd openssl-${OPENSSL_VERSION}; \
-    ./config no-shared no-zlib -fPIC -DOPENSSL_NO_SECURE_MEMORY; \
-    make; \
-    make install; \
-    cd ..; \
-    rm -rf openssl-${OPENSSL_VERSION} openssl-${OPENSSL_VERSION}.tar.gz
-
-ENV RUSTUP_HOME=/usr/local/rustup \
-    CARGO_HOME=/usr/local/cargo \
-    PATH=/usr/local/cargo/bin:$PATH \
-    RUSTUP_VERSION=1.24.2 \
-    RUSTUP_SHA256=6d6d0da8940357eeed733368a6a63fc96e8a1ed1e02fa4c4a60b64b6c66b6057 \
-    RUST_ARCH=x86_64-unknown-linux-gnu
-
-RUN set -eux; \
-    url="https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${RUST_ARCH}/rustup-init"; \
-    wget "$url"; \
-    echo "${RUSTUP_SHA256} *rustup-init" | sha256sum -c -; \
-    chmod +x rustup-init
-
-ENV RUST_VERSION=1.51.0
-
-RUN set -eux; \
-    ./rustup-init -y --no-modify-path --default-toolchain $RUST_VERSION; \
-    rm rustup-init; \
-    chmod -R a+w $RUSTUP_HOME $CARGO_HOME; \
-    rustup --version; \
-    cargo --version; \
-    rustc --version; \
-    openssl version;